Re: Anyone else seeing lots of 129 20 this am?

["Joel Esler \(jesler\) via Snort-users" <snort-users () lists snort org>]

When you say "something changed", do you mean "Snort" changed.  Or "attacker behavior" may be changing?

> On Aug 30, 2019, at 8:13 AM, James Lay via Snort-users <snort-users () lists snort org> wrote:
>
> Yea something changed....I run ssh on a non-standard port and now I'm seeing:
>
> [120:18:3] (http_inspect) PROTOCOL-OTHER HTTP server response before client request
>
> after updating rules this AM:
>
> Aug 30 01:10:22 snort[31692]: Decoding Ethernet
> Aug 30 01:17:53 snort[31692]: [120:18:3] (http_inspect) PROTOCOL-OTHER HTTP server response before client request
>
> that http_inspect hit rule is the first time I've seen that in my logs....ever 😉
>
> James
>
>
> On Fri, 2019-08-30 at 06:05 -0600, James Lay via Snort-users wrote:
> > Seeing massive amounts of [129:20:1] TCP session without 3-way handshake this morning....seems to be firing off on 
> > RST packets.
> >
> > James
> >
> > <Screenshot from 2019-08-30 06-05-03.png>
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists snort org <mailto:Snort-users () lists snort org>
> > Go to this URL to change user options or unsubscribe:
> > https://lists.snort.org/mailman/listinfo/snort-users <https://lists.snort.org/mailman/listinfo/snort-users>
> >
> >      To unsubscribe, send an email to:
> >      snort-users-leave () lists snort org <mailto:snort-users-leave () lists snort org>
> >
> > Please visit http://blog.snort.org <http://blog.snort.org/> to stay current on all the latest Snort news!
> >
> > Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette 
> > <https://snort.org/faq/what-is-the-mailing-list-etiquette>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
>       To unsubscribe, send an email to:
>       snort-users-leave () lists snort org
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Attachment: smime.p7s
Description:

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette