Re: Anyone else seeing lots of 129 20 this am?

[James Lay via Snort-users <snort-users () lists snort org>]

Yea something changed....I run ssh on a non-standard port and now I'm
seeing:

[120:18:3] (http_inspect) PROTOCOL-OTHER HTTP server response before
client request

after updating rules this AM:

Aug 30 01:10:22 snort[31692]: Decoding Ethernet
Aug 30 01:17:53 snort[31692]: [120:18:3] (http_inspect) PROTOCOL-OTHER
HTTP server response before client request

that http_inspect hit rule is the first time I've seen that in my
logs....ever 😉

James


On Fri, 2019-08-30 at 06:05 -0600, James Lay via Snort-users wrote:
> Seeing massive amounts of [129:20:1] TCP session without 3-way
> handshake this morning....seems to be firing off on RST packets.
>
> James
>
>
>
> _______________________________________________Snort-users mailing
> listSnort-users@lists.snort.orgGo to this URL to change user options
> or unsubscribe:https://lists.snort.org/mailman/listinfo/snort-users
>       To unsubscribe, send an email to:       
> snort-users-leave () lists snort org
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
> Please follow these rules: 
> https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette