Snort mailing list archives
Re: Barnyard2 configuration and event generation
From: Steve Marotta <smarotta () cra com>
Date: Wed, 19 Dec 2012 13:39:47 -0500
Okay, that's closer. Here, I have an example of the sort of thing that I'm looking for. I have log files generated by some process that is unknown to me, but it's along the lines of the kind of detail that I want. I want to know how to generate output similar to the following: 10/01/06-17:14:08.905284 [**] [1:466:4] ICMP L3retriever Ping [**] [Classification: Attempted Information Leak] [Priority: 2] {ICMP} 100.10.20.7 -> 100.10.20.3 10/01/06-17:14:08.906552 [**] [1:466:4] ICMP L3retriever Ping [**] [Classification: Attempted Information Leak] [Priority: 2] {ICMP} 100.10.20.7 -> 100.10.20.3 10/01/06-17:14:08.909629 [**] [1:3003:4] NETBIOS SMB-DS Session Setup NTMLSSP unicode asn1 overflow attempt [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 100.10.20.7:3045 -> 100.10.20.3:445 10/01/06-17:14:08.912910 [**] [1:2466:7] NETBIOS SMB-DS IPC$ unicode share access [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 100.10.20.7:3045 -> 100.10.20.3:445 10/01/06-17:14:14.394597 [**] [1:466:4] ICMP L3retriever Ping [**] [Classification: Attempted Information Leak] [Priority: 2] {ICMP} 100.10.20.8 -> 100.10.20.3 10/01/06-17:14:14.395833 [**] [1:466:4] ICMP L3retriever Ping [**] [Classification: Attempted Information Leak] [Priority: 2] {ICMP} 100.10.20.8 -> 100.10.20.3 10/01/06-17:14:14.398579 [**] [1:3003:4] NETBIOS SMB-DS Session Setup NTMLSSP unicode asn1 overflow attempt [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 100.10.20.8:3054 -> 100.10.20.3:445 10/01/06-17:14:14.401683 [**] [1:2466:7] NETBIOS SMB-DS IPC$ unicode share access [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 100.10.20.8:3054 -> 100.10.20.3:445 10/01/06-17:14:20.129381 [**] [1:466:4] ICMP L3retriever Ping [**] [Classification: Attempted Information Leak] [Priority: 2] {ICMP} 100.10.20.10 -> 100.10.20.3 10/01/06-17:14:20.130816 [**] [1:466:4] ICMP L3retriever Ping [**] [Classification: Attempted Information Leak] [Priority: 2] {ICMP} 100.10.20.10 -> 100.10.20.3 10/01/06-17:14:20.133548 [**] [1:3003:4] NETBIOS SMB-DS Session Setup NTMLSSP unicode asn1 overflow attempt [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 100.10.20.10:3145 -> 100.10.20.3:445 10/01/06-17:14:20.136576 [**] [1:2466:7] NETBIOS SMB-DS IPC$ unicode share access [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 100.10.20.10:3145 -> 100.10.20.3:445 THIS MESSAGE IS INTENDED FOR THE USE OF THE PERSON TO WHOM IT IS ADDRESSED. IT MAY CONTAIN INFORMATION THAT IS PRIVILEGED, CONFIDENTIAL AND EXEMPT FROM DISCLOSURE UNDER APPLICABLE LAW. If you are not the intended recipient, your use of this message for any purpose is strictly prohibited. If you have received this communication in error, please delete the message and notify the sender so that we may correct our records. ------------------------------------------------------------------------------ LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and focus on delivering more value-add services Discover what IT Professionals Know. Rescue delivers http://p.sf.net/sfu/logmein_12329d2d _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Barnyard2 configuration and event generation Steve Marotta (Dec 19)
- Re: Barnyard2 configuration and event generation beenph (Dec 19)
- Re: Barnyard2 configuration and event generation Steve Marotta (Dec 19)
- Re: Barnyard2 configuration and event generation beenph (Dec 19)
- Re: Barnyard2 configuration and event generation Steve Marotta (Dec 19)
- Re: Barnyard2 configuration and event generation waldo kitty (Dec 19)
- Alerts are almost entirely "Executable Code was Detected" Steve Marotta (Dec 20)
- Re: Alerts are almost entirely "Executable Code was Detected" Joel Esler (Dec 20)
- Re: Barnyard2 configuration and event generation Steve Marotta (Dec 19)
- Re: Barnyard2 configuration and event generation beenph (Dec 19)