Snort mailing list archives
RE: frag3 alerts
From: "Drew Burchett" <DrewB () united-systems com>
Date: Mon, 22 May 2006 13:27:07 -0500
From examining the packet capture, I've determined that the "offending"
traffic is an NXDomain response from a valid root server. It's being caused by doing reverse lookups on spam email. However, the question remains, is there any way I can fine tune the frag3 preprocessor to avoid these false positives? Drew Burchett United Systems & Software http://www.united-systems.com Phone: (270)527-3293 Fax: (270)527-3132 _____ From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Drew Burchett Sent: Monday, May 22, 2006 11:18 AM To: snort-users () lists sourceforge net Subject: [Snort-users] frag3 alerts I am seeing a lot of frag3 Fragmentation overlap alerts with my DNS server as the destination and a source address that reverses to a root server. When examining the packets, the traffic seems to be valid DNS traffic, although it has nothing to do with any domains that I host. Is this some sort of attack, or is it valid traffic that is throwing false positives? If it is a false positive, is there any way I can fine-tune the frag3 preprocessor to avoid these? Drew Burchett United Systems & Software http://www.united-systems.com Phone: (270)527-3293 Fax: (270)527-3132 -- CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. -- This message has been scanned for viruses and dangerous content by MailScanner <http://www.mailscanner.info/> , and is believed to be clean. -- CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. -- This message has been scanned for viruses and dangerous content by MailScanner and is believed to be clean.
Current thread:
- frag3 alerts Drew Burchett (May 22)
- <Possible follow-ups>
- RE: frag3 alerts Drew Burchett (May 22)
- Re: frag3 alerts Joel Esler (May 22)
- RE: frag3 alerts Drew Burchett (May 22)
- Re: frag3 alerts Joel Esler (May 22)
- RE: frag3 alerts Drew Burchett (May 22)