Snort mailing list archives

Interesting entries in BASE


From: CasperLinux <CasperLinux () comcast net>
Date: Sun, 26 Feb 2006 18:11:04 -0500

This evening I'm evaluating the success of my newly created .htaccess file and 
found that I have several portscan entries originating from within my 
network.  Destination is both inside and outside my local LAN.  Below is the 
payload from one of these events.  Does anyone have any input as to what may 
be causing this? I am NOT running any portscan program that I am aware of.

length = 140

000 : 50 72 69 6F 72 69 74 79 20 43 6F 75 6E 74 3A 20   Priority Count: 
010 : 39 0A 43 6F 6E 6E 65 63 74 69 6F 6E 20 43 6F 75   9.Connection Cou
020 : 6E 74 3A 20 35 0A 49 50 20 43 6F 75 6E 74 3A 20   nt: 5.IP Count: 
030 : 35 0A 53 63 61 6E 6E 65 64 20 49 50 20 52 61 6E   5.Scanned IP Ran
040 : 67 65 3A 20 31 39 32 2E 31 36 38 2E 30 2E 34 32   ge: 192.168.0.42
050 : 3A 36 34 2E 31 35 34 2E 38 30 2E 32 35 34 0A 50   :64.154.80.254.P
060 : 6F 72 74 2F 50 72 6F 74 6F 20 43 6F 75 6E 74 3A   ort/Proto Count:
070 : 20 35 0A 50 6F 72 74 2F 50 72 6F 74 6F 20 52 61    5.Port/Proto Ra
080 : 6E 67 65 3A 20 32 31 3A 34 34 33 0A                               nge: 21:443.

Don
-- 
- Powered by Debian Linux - 


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: