Preventing Attacks

["David Alexandre M. de Carvalho" <david () medusa ubi pt>]

Hi all !

I've installed SNORT a few months ago to monitor some network activity.
Lately I've noted several messages in the log file, something like:

WEB-IIS cmd.exe [**] [Classification: Web Application Attack] .....
WEB-IIS ISAPI .ida attempt [**] [Classification: Web Application Attack]
.....

SCAN Proxy attempt [**] [Classification: Attempted information leak]
ICMP superscan echo [**] [Classification: Attempted information leak]

WEB-IIS CodeRed v2 root.exe access [**] [Classification: Web Application
Attack] .....


I installed the machines with maximum security, some firewall configuration,
etc
Can anyone help with this ? Any ideas ?
Thanks.
David Carvalho