[Snort-sigs] What does this mean?

Erek Adams erek at ...95...
Tue Jul 1 10:27:10 EDT 2003


On Tue, 1 Jul 2003, Michael Breton wrote:

> I have been receiving he following info in my log regularly.  What does it
> mean?
>
> Jun 29 14:50:50 special snort: [ID 702911 auth.alert] [111:1:1]
> (spp_stream4) STEALTH ACTIVITY (unknown) detection {TCP} 142.167.32.146:1701
> -> my.web.server.address:80
>
> Should I be concerned?

Depends.

Have a look at the acutal packet.  See what's going on inside it.



More information about the Snort-sigs mailing list