RE: ATTACK-RESPONSES id check returned root

[Our World Is Here <info () lucretia ca>]

I see this so often I've revised this sid (498 I think) to ignore anything
coming via POP port 110.  If I see it on 25 I get worried...


Cheers,


James Friesen, CIO

Lucretia Enterprises
"Our World Is Here..."
Info at lucretia dot ca
http://lucretia.ca


> -----Original Message-----
> From: cc [mailto:cc () belfordhk com]
> Sent: Saturday, October 22, 2005 12:17 AM
> To: Chris Romano
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] ATTACK-RESPONSES id check returned root
>
> Chris Romano sighed and wrote::
>
> > I came in this moring and checked my snort alerts (morning
> routine),
> > and noticed the following:
> >
> > ATTACK-RESPONSES id check returned root 2005-10-21 07:40:32
> > 82.165.25.125:80<http://82.165.25.125:80>
> > 10.10.10.5:51949 <http://10.10.10.5:51949> TCP
>
> This is very interesting.  Snort tagged your message with the
> same exact alert, but this time it was through port 25
> (SMTP).  At first, I freaked when I saw that on BASE.  Then I
> checked the payload and got worried.
>
> However, looking at the port, and noticing it was 25, and
> finding it in my email, I sighed a relief.  :)
>
> Edmund
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by:
> Power Architecture Resource Center: Free content, downloads,
> discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.
Get Certified Today * Register for a JBoss Training Course
Free Certification Exam for All Training Attendees Through End of 2005
Visit http://www.jboss.com/services/certification for more information
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users