Re: MISC IP Reserved bit set

["Matthew Collins" <Matthew.Collins () northernregistrars co uk>]

Look at the source port. 80 -> YourIP:35434.

Been downloading some rules from the snort web site?

> > > "Frontgate Lab" <mdiwan () wagweb com> 12/10/01 16:02:13 >>>
Hiya .. errm.. i think this is bad... i belive it is nimda:

Oct 11 11:48:35 fglab snort[4483]: [1:1284:3] WEB-MISC readme.eml
attempt [Classification: Attempted User Privilege Gain] [Priority: 8]:
{TCP} 151.196.107.166:80 -> 192.168.150.203:35434

nslookup results:

 nslookup 151.196.107.166
Note:  nslookup is deprecated and may be removed from future releases.
Consider using the `dig' or `host' programs instead.  Run nslookup with
the `-sil[ent]' option to prevent this message from appearing.
Server:         207.150.196.199
Address:        207.150.196.199#53

Non-authoritative answer:
166.107.196.151.in-addr.arpa    name = snort.sourcefire.com.

Authoritative answers can be found from:
166.107.196.151.in-addr.arpa    nameserver = ns1.sourcefire.com.
166.107.196.151.in-addr.arpa    nameserver = ns2.sourcefire.com.
ns1.sourcefire.com      internet address = 151.196.107.164
ns2.sourcefire.com      internet address = 151.196.107.165




****************************************************************************************
This message and any attachments are confidential to the ordinary user of
the e-mail address to which it was addressed and may also be privileged.
If you are not the addressee you may not copy, forward, disclose or use 
any part of the message or its attachments and if you have received this
message in error, please notify the sender immediately by return e-mail and
delete it from your system.
Internet communications cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, arrive late or contain
viruses. The sender therefore does not accept liability for any errors or
omissions in the context of this message which arise as a result of Internet
transmission.
Northern Registrars Limited, Northern House, Woodsome Park, Fenay 
Bridge, Huddersfield. HD8 0LA.
Tel: +44 (0) 1484 600900  Fax: +44 (0) 1484 600911
For more information visit our web site: http://www.northernregistrars.co.uk
****************************************************************************************


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users