Snort mailing list archives
Re: CyberKit 2.2 Ping, its driven me Nuts..
From: lindsay.hunt () itc alstom com
Date: Mon, 29 Dec 2003 11:19:02 -0500
I have found this rule to be extremely valuable in terms of finding infected hosts. Yes, it is difficult to track down all of the cyberkit alerts, but the trade off is much worse; an infected network. Our network permformance was severely affected when the Nachi/Welchia worm was released. The cyberkit rule (in addition to firewall logs) helped us identify the infected machines so that they could be removed from the network and cleaned. I don't really want hundreds of thousands of pings traversing our network looking for machines to compromise. regards, Lindsay Hunt Network Engineer Alstom Power phone 804-763-7239 mobile 804-334-1682 fax 804-763-7107 Roberto Suarez Soto <robe () alfa21 com> To: snort-users () lists sourceforge net cc: Sent by: Subject: Re: [Snort-users] CyberKit 2.2 Ping, its driven me Nuts.. snort-users-admin () lists sour ceforge.net 12/29/2003 11:13 AM On Dec/29, Chris N wrote:
Ok, I have had enough of this "CyberKit 2.2 Ping." How are some of you
guys
dealing with it? Do you just ignore(pass), log every one, or go and try
to
shut the offending hosts down? Although, trying to shutdown all the offending host could be a daunting task, since there are so dam many.
I just switched that rule off. I couldn't bear it anymore O:-) -- Roberto Suarez Soto Alfa21 Outsourcing robe () alfa21 com http://www.alfa21.com ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users CONFIDENTIALITY : This e-mail and any attachments are confidential and may be privileged. If you are not a named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose or store or copy the information in any medium. ------------------------------------------------------- This SF.net email is sponsored by: IBM Linux Tutorials. Become an expert in LINUX or just sharpen your skills. Sign up for IBM's Free Linux Tutorials. Learn everything from the bash shell to sys admin. Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: CyberKit 2.2 Ping, its driven me Nuts.., (continued)
- Re: CyberKit 2.2 Ping, its driven me Nuts.. Bryan Irvine (Dec 29)
- SUMMARY, CyberKit 2.2 Ping, its driven me Nuts.. Chris N (Dec 31)
- Re: SUMMARY, CyberKit 2.2 Ping, its driven me Nuts.. Jeff Kell (Dec 31)
- RE: CyberKit 2.2 Ping, its driven me Nuts.. CMartin (Dec 29)
- RE: CyberKit 2.2 Ping, its driven me Nuts.. Bryan Irvine (Dec 29)
- Re: CyberKit 2.2 Ping, its driven me Nuts.. dlbox (Dec 29)
- RE: CyberKit 2.2 Ping, its driven me Nuts.. Thompson, Jimi (Dec 29)
- Re: CyberKit 2.2 Ping, its driven me Nuts.. Matthew L. McCarty (Dec 29)
- Re: CyberKit 2.2 Ping, its driven me Nuts.. Alexander Hampel (Dec 29)
- RE: CyberKit 2.2 Ping, its driven me Nuts.. CGhercoias (Dec 29)
- Re: CyberKit 2.2 Ping, its driven me Nuts.. lindsay . hunt (Dec 30)