snoop output contradicts with snort database

[Gongya Yu <yu () gongya net>]

Hi, all:

    I have a win2k box compromised. After I boot up that box, I use snoop to find that it sends

lots of packets to remote machines on port 80 from random local ports. I set up a snort box to plugin to oracle

database. When I query tcphdr table, I found tcp_sport contains port 80, while tcp_dport contains random ports.

any suggestions.

Gongya Yu

=================================