INVALIDACK

["Paul Asadoorian" <paul.com () home com>]

Snort Users,

I get these a few times a day, always on port 80, always destined for a
proxy server, and always with the following flags set.  I am using snort
1.7-rel.  Any help is greatly appreciated.

Paul
May 17 10:24:13 192.193.195.132:80 -> MY.NET.1.36:3012 INVALIDACK ***A*R*F
May 17 10:24:19 192.193.195.132:80 -> MY.NET.1.36:3007 INVALIDACK ***A*R*F
May 17 10:24:17 192.193.195.132:80 -> MY.NET.1.36:3022 INVALIDACK ***A*R*F
May 17 10:24:15 192.193.195.132:80 -> MY.NET.1.36:3012 INVALIDACK ***A*R*F
May 17 10:24:17 192.193.195.132:80 -> MY.NET.1.36:2983 INVALIDACK ***A*R*F
May 17 10:24:18 192.193.195.132:80 -> MY.NET.1.36:2942 INVALIDACK ***A*R*F
May 17 10:24:20 192.193.195.132:80 -> MY.NET.1.36:3012 INVALIDACK ***A*R*F
May 17 10:24:20 192.193.195.132:80 -> MY.NET.1.36:2937 INVALIDACK ***A*R*F
May 17 10:24:21 192.193.195.132:80 -> MY.NET.1.36:3022 INVALIDACK ***A*R*F
May 17 10:24:25 192.193.195.132:80 -> MY.NET.1.36:2983 INVALIDACK ***A*R*F
May 17 10:24:27 192.193.195.132:80 -> MY.NET.1.36:3007 INVALIDACK ***A*R*F
May 17 10:24:27 192.193.195.132:80 -> MY.NET.1.36:3012 INVALIDACK ***A*R*F
May 17 10:24:36 192.193.195.132:80 -> MY.NET.1.36:2937 INVALIDACK ***A*R*F
May 17 10:24:41 192.193.195.132:80 -> MY.NET.1.36:3197 INVALIDACK ***A*R*F
May 17 10:24:41 192.193.195.132:80 -> MY.NET.1.36:3198 INVALIDACK ***A*R*F
May 17 10:24:45 192.193.195.132:80 -> MY.NET.1.36:3197 INVALIDACK ***A*R*F
May 17 10:24:45 192.193.195.132:80 -> MY.NET.1.36:3198 INVALIDACK ***A*R*F
May 17 10:24:53 192.193.195.132:80 -> MY.NET.1.36:3197 INVALIDACK ***A*R*F
May 17 10:24:53 192.193.195.132:80 -> MY.NET.1.36:3198 INVALIDACK ***A*R*F


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users