Re: Anyone else seeing lots of 129 20 this am?

["Michael Steele" <michaels () winsnort com>]

I noticed that too on the last Snort update. Getting a LOT more alerts. I also updated the rules at the same time and 
never went back to the old rules to see if that was where the change came in? 

WINSNORT.com Management Team Member
--
********************************************************
*     Since 2002 ~~ Visit http://www.winsnort.com
*      ~~ FREE Windows installation Tutorials ~~
*              ~~ FREE Support Forums ~~
* Snort: Open Source Network IDS - http://www.snort.org
********************************************************

-----Original Message-----
From: Snort-users <snort-users-bounces () lists snort org> On Behalf Of James Lay via Snort-users
Sent: Friday, August 30, 2019 11:26 AM
To: Joel Esler (jesler) <jesler () cisco com>
Cc: Snort <snort-users () lists snort org>
Subject: Re: [Snort-users] Anyone else seeing lots of 129 20 this am?

Something as in snort ;)  Same traffic, a LOT more alerts right after updates.

On 2019-08-30 09:23, Joel Esler (jesler) wrote:
> When you say "something changed", do you mean "Snort" changed.  Or 
> "attacker behavior" may be changing?
>
> > On Aug 30, 2019, at 8:13 AM, James Lay via Snort-users 
> > <snort-users () lists snort org> wrote:
> >
> > Yea something changed....I run ssh on a non-standard port and now I'm 
> > seeing:
> >
> > [120:18:3] (http_inspect) PROTOCOL-OTHER HTTP server response before 
> > client request
> >
> > after updating rules this AM:
> >
> > Aug 30 01:10:22 snort[31692]: Decoding Ethernet Aug 30 01:17:53 
> > snort[31692]: [120:18:3] (http_inspect) PROTOCOL-OTHER HTTP server 
> > response before client request
> >
> > that http_inspect hit rule is the first time I've seen that in my 
> > logs....ever 😉
> >
> > James
> >
> > On Fri, 2019-08-30 at 06:05 -0600, James Lay via Snort-users wrote:
> >
> > > Seeing massive amounts of [129:20:1] TCP session without 3-way 
> > > handshake this morning....seems to be firing off on RST packets.
> > >
> > > James
> > >
> > > <Screenshot from 2019-08-30 06-05-03.png>
> > >
> > > _______________________________________________
> > >
> > > Snort-users mailing list
> > >
> > > Snort-users () lists snort org
> > >
> > > Go to this URL to change user options or unsubscribe:
> > >
> > > https://lists.snort.org/mailman/listinfo/snort-users
> > >
> > > To unsubscribe, send an email to:
> > >
> > > snort-users-leave () lists snort org
> > >
> > > Please visit http://blog.snort.org [1] to stay current on all the 
> > > latest Snort news!
> > >
> > > Please follow these rules:
> > > https://snort.org/faq/what-is-the-mailing-list-etiquette
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists snort org
> > Go to this URL to change user options or unsubscribe:
> > https://lists.snort.org/mailman/listinfo/snort-users
> >
> > To unsubscribe, send an email to:
> > snort-users-leave () lists snort org
> >
> > Please visit http://blog.snort.org to stay current on all the latest 
> > Snort news!
> >
> > Please follow these rules:
> > https://snort.org/faq/what-is-the-mailing-list-etiquette
>
>
>
> Links:
> ------
> [1] http://blog.snort.org/
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette