Re: Anyone else seeing lots of 129 20 this am?

[James Lay via Snort-users <snort-users () lists snort org>]

"Ok George fine...it's not me, it's you.."

On 2019-08-30 10:22, Daniel Rieille wrote:
> Yes. The same for me! Thousands of 129 20 this morning on the same
> network traffic.
>
> Le ven. 30 août 2019 à 18:08, James Lay via Snort-users
> <snort-users () lists snort org> a écrit :
>
> > Something as in snort ;)  Same traffic, a LOT more alerts right
> > after
> > updates.
> >
> > On 2019-08-30 09:23, Joel Esler (jesler) wrote:
> > > When you say "something changed", do you mean "Snort" changed.  Or
> > > "attacker behavior" may be changing?
> > >
> > > > On Aug 30, 2019, at 8:13 AM, James Lay via Snort-users
> > > > <snort-users () lists snort org> wrote:
> > > >
> > > > Yea something changed....I run ssh on a non-standard port and now
> > > > I'm seeing:
> > > >
> > > > [120:18:3] (http_inspect) PROTOCOL-OTHER HTTP server response
> > before
> > > > client request
> > > >
> > > > after updating rules this AM:
> > > >
> > > > Aug 30 01:10:22 snort[31692]: Decoding Ethernet
> > > > Aug 30 01:17:53 snort[31692]: [120:18:3] (http_inspect)
> > > > PROTOCOL-OTHER HTTP server response before client request
> > > >
> > > > that http_inspect hit rule is the first time I've seen that in my
> > > > logs....ever 😉
> > > >
> > > > James
> > > >
> > > > On Fri, 2019-08-30 at 06:05 -0600, James Lay via Snort-users
> > wrote:
> > > > > Seeing massive amounts of [129:20:1] TCP session without 3-way
> > > > > handshake this morning....seems to be firing off on RST packets.
> > > > >
> > > > > James
> > > > >
> > > > > <Screenshot from 2019-08-30 06-05-03.png>
> > > > >
> > > > > _______________________________________________
> > > > >
> > > > > Snort-users mailing list
> > > > >
> > > > > Snort-users () lists snort org
> > > > >
> > > > > Go to this URL to change user options or unsubscribe:
> > > > >
> > > > > https://lists.snort.org/mailman/listinfo/snort-users
> > > > >
> > > > > To unsubscribe, send an email to:
> > > > >
> > > > > snort-users-leave () lists snort org
> > > > >
> > > > > Please visit http://blog.snort.org [1] to stay current on all
> > the
> > > > > latest Snort news!
> > > > >
> > > > > Please follow these rules:
> > > > > https://snort.org/faq/what-is-the-mailing-list-etiquette
> > > >
> > > > _______________________________________________
> > > > Snort-users mailing list
> > > > Snort-users () lists snort org
> > > > Go to this URL to change user options or unsubscribe:
> > > > https://lists.snort.org/mailman/listinfo/snort-users
> > > >
> > > > To unsubscribe, send an email to:
> > > > snort-users-leave () lists snort org
> > > >
> > > > Please visit http://blog.snort.org to stay current on all the
> > latest
> > > > Snort news!
> > > >
> > > > Please follow these rules:
> > > > https://snort.org/faq/what-is-the-mailing-list-etiquette
> > >
> > >
> > >
> > > Links:
> > > ------
> > > [1] http://blog.snort.org/
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists snort org
> > Go to this URL to change user options or unsubscribe:
> > https://lists.snort.org/mailman/listinfo/snort-users
> >
> > To unsubscribe, send an email to:
> > snort-users-leave () lists snort org
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> > Snort news!
> >
> > Please follow these rules:
> > https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette