Re: Can't suppress Tagged Packet

[Rob Ward <rob.ward () liverpool ac uk>]

--On 26 May 2006 09:40 -0400 Joel Esler <joel.esler () sourcefire com> wrote:

> Suppose you can copy and paste (take out the IP's) the alert you are
> getting?
>
> Joel

Strange - these aren't appearing in my sensors alert files only the 
database and seem to be related to the following alerts triggered by a 
Bleeding Snort Rule which DO appear in the alert file:

> [**] [1:2000347:5] BLEEDING-EDGE ATTACK RESPONSE IRC - Private message on
> non-std port [**] [Classification: A Network Trojan was detected]
> [Priority: 1]
> 05/26-14:54:24.064891 0:9:E9:A5:F8:0 -> 0:E:39:92:4C:0 type:0x800 len:0x6A
> X.X.X.X:2353 -> 85.158.9.6:8000 TCP TTL:127 TOS:0x0 ID:8172
> IpLen:20 DgmLen:92 DF ***AP*** Seq: 0x1EA9AEA7  Ack: 0x769ADDBF  Win:
> 0xFC00  TcpLen: 20

On investigation the majority of these are false positives but some can be 
linked to Botnets.

The corresponding Tagged Packet alert that's in the database is:

> Generated by BASE v1.2.2 (cindy) on Fri, 26 May 2006 15:06:19 +0100
>
> -------------------------------------------------------------------------
> -----
> # (6 - 221802) [2006-05-26 14:54:24] [snort/1]  Tagged Packet
> IPv4: X.X.X.X -> 85.158.9.6
>       hlen=5 TOS=0 dlen=92 ID=8172 flags=0 offset=0 TTL=127 chksum=16965
> TCP:  port=2353 -> dport: 8000  flags=***AP*** seq=514436775
>       ack=1989860799 off=5 res=0 win=64512 urp=0 chksum=46007
> Payload:  length = 52
>
> 000 : 50 52 49 56 4D 53 47 20 23 75 6B 5F 6C 69 76 65   PRIVMSG #uk_live
> 010 : 72 70 6F 6F 6C 5F 63 72 75 69 73 69 6E 67 20 3A   rpool_cruising :
> 020 : 41 4E 59 31 20 57 41 4E 4E 41 20 43 48 41 54 3F   ANY1 WANNA CHAT?
> 030 : 3F 3F 0D 0A                                       ??..

Thanks

Rob Ward
Network Northwest Support
University of Liverpool
Computing Services Department 


-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users