Snort mailing list archives
Re: WEB-CLIENT Excel malformed FBI record - False positive?
From: Jesper Skou Jensen <jesper.skou.jensen () uni-c dk>
Date: Tue, 08 Jul 2008 15:25:00 +0200
Jesper Skou Jensen wrote:
Jack Pepper wrote:[Replies are inline] Quoting Jesper Skou Jensen <jesper.skou.jensen () uni-c dk>:1. The user client is on the outside of our network and is accessing one of our servers on the inside.No No No. you've got it backwards.2. This rule must be triggered because of a already established connection, like this. Initial connnection outside_client:highport -> inside_server:80 Response when user downloads inside_server:80 -> outside_client:highport Correct?No. The session sets up as "inside_server:high_port -> outside_client:80". It's probably one of your workstations, not one of your servers.That is exactly what is happening. A outside user is downloading a word document from one of the servers.No. An *inside* user is downloading a word doc from an *outside* server.Thanks for clearing that up for me.It seems I really didn't do that very well. ;/Hmm well, I believe the problem might be that our current configuration/setup isn't what you expect and/or that we are talking about the same thing, in two different ways... I'll try to make a sketch of it here: SomeUnknownClient (10.1.1.1) | Internet | Router/Switch | SnortBox & WebServer (10.2.2.2) As far as I see it, the client (10.1.1.1) connects to 10.2.2.2 and downloads a Word document, and that triggered the Snort Alert. It MIGHT be that the client was uploading the Word document, but I'll have to look into some logfiles to be sure about this, if you think that's what triggered the alert? If this was how you imagined our setup then please try to explain the above in another way.
Crap, I've reversed the IPs from the mail that started the topic. Anyways, I hope you understand. -- Jesper S. Jensen Basisnet og Sikkerhed Uni-C - Ã…rhus, Danmark ------------------------------------------------------------------------- Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW! Studies have shown that voting for your favorite open source project, along with a healthy diet, reduces your potential for chronic lameness and boredom. Vote Now at http://www.sourceforge.net/community/cca08 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 07)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 07)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? List Subscriptions (Jul 07)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Joel Esler (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 08)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jesper Skou Jensen (Jul 09)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Joel Esler (Jul 09)
- Re: WEB-CLIENT Excel malformed FBI record - False positive? Jack Pepper (Jul 08)