Re: Would you suspect?

[Chris Green <cmg () sourcefire com>]

"Ronneil Camara" <ronneilc () remingtonltd com> writes:

> Hi guys,
>
> I am receiving a lot of alerts from my snort, WEB-MISC 403 Forbidden.
> The source is actually our web server going to a public ip address.
> Would you suspect that the destination ip is trying to hopefully, make
> a dir listing of our virtual directory? What's your analysis?


yup typically. Are there any other alerts related to the public ip?
-- 
Chris Green <cmg () sourcefire com>
"Yeah, but you're taking the universe out of context."


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users