Re: How should alerts be interpreted? hacker's_machine -> victim's_machine?

["Palula Brasil" <palula () uol com br>]

What would be these other variables? For example, I don't have a webserver,
database, I have an internal ftp and that's all. At least for now.

----- Original Message ----- 
From: "Joel Esler" <joel.esler () sourcefire com>
To: <patrick () internetsecurityguru com>
Cc: "'Palula Brasil'" <palula () uol com br>;
<snort-users () lists sourceforge net>
Sent: Thursday, April 13, 2006 4:48 PM
Subject: Re: [Snort-users] How should alerts be interpreted?
hacker's_machine -> victim's_machine?


I suggest that you define all your variables inside of the snort.conf.
There are many to configure.  -h is only one.

J

Patrick S. Harper wrote:
> That is also assuming that you have all your variables set correctly.
>
> -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Palula
Brasil
> Sent: Thursday, April 13, 2006 1:12 PM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] How should alerts be interpreted?
hacker's_machine ->
> victim's_machine?
>
> Ok! Alerts are workin fine. But indeed there is another problem.
> Here is the problem: the alert file has these.
>
> [**] [122:7:0] (portscan) TCP Filtered Portsweep [**]
> 04/12-22:30:29.305031 x.x.x.x:port -> 38.119.49.39
> PROTO255 TTL:0 TOS:0x0 ID:5901 IpLen:20 DgmLen:162 DF
>
> and...
>
> [**] [119:15:1] (http_inspect) OVERSIZE REQUEST-URI DIRECTORY [**]
> 04/12-23:14:22.648030 x.x.x.x:port -> 66.165.172.181:80
> TCP TTL:64 TOS:0x0 ID:30828 IpLen:20 DgmLen:1452 DF
> ***A**** Seq: 0x3B8C6DA9  Ack: 0x7AAF4300  Win: 0x5AC  TcpLen: 32
> TCP Options (3) => NOP NOP TS: 54649465 770359521
>
> But the thing is that x.x.x.x:port is my machines IP and port. Looks like
> it's gone mad and is doing totally random port scans and http inspects on
> whatever machines.
>
> According to snort docs, the correct interpretation for these alerts is:
> hacker's machine -> victim's machines
>
> Has my machine gone mad and is making victims out of a sudden? Home
network
> ( -h x.x.x.x/x) has been defined, by the way.
>
> Thanks! :-)
>
>
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by xPML, a groundbreaking scripting
language
> that extends applications into web and mobile media. Attend the live
webcast
> and join the prime developer group breaking into this new coding
territory!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users