[Snort-sigs] FPs: EXPLOIT Veritas Backup Agent DoS attempt,Sig ID,3696

Russell Fulton r.fulton at ...575...
Thu Feb 9 12:30:03 EST 2006


I have a couple of thousand of these triggered by Bittorrent traffic:

META
--------
SID	CID	TimeStamp		Signature
6	7983912	2006-02-09 23:46:42	EXPLOIT Veritas Backup Agent DoS attempt
Sig ID
3696

Sensor Hostname				Sensor Interface
hihi.insec.auckland.ac.nz	new dmz sensor

IP
--------
Source Address	Dest Address	Ver	Hdr Len
130.216.226.204	80.195.60.140	4	5
TOS	length	ID	flags	offset	TTL	chksum
0	1500	58619	2	0	124	8492

Resolved Source
j.leef.afac.auckland.ac.nz

Resolved Dest
80-195-60-140.cable.ubr04.uddi.blueyonder.co.uk

TCP
--------
Source Port	Dest Port	Seq		Ack		
2953		10000		1339957372	2155276165
Offset	Reserved	Flags	Window	Checksum	Urgent Ptr
5	0		16	64183	44698		0

Options
--------
None


Flags
--------
RB 1	RB 0	URG	ACK	PSH	RST	SYN	FIN
			X					

DATA
--------
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F475C	........G\
0FD7BFEE6047F4C7F233	....`G...3
C11A9DBC3FD73FEB9FAC	....?.?...
ED7F277E1BF987F8DB90	..'~......
0686EFEEB78ABCB7C6AB	..........
F8A8E790066000000000	.....`....
00000000000000F9AF77	.........w
E276BF0D9BC24627BFE8	.v....F'..
0FACEFFF30FE1B9F475D	....0...G]
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F475E	........G^
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F475F	........G_
0F9006FAE3B2106A9A04	.......j..
06770414399006BB1FC9	.w..9.....
1ED77B6BD8DCDDB7F990	..{k......
0630FF2CA13963B52892	.0.,.9c.(.
6C87F1900691BEB304A0	l.........
29A745895C481C001693	).E.\H....
A949D134B437F60026EF	.I.4.7..&.
CE9B9EFAD9992D9F4760	......-.G`
0F9006895164B5EFE641	....Qd...A
FC8140A1809006000000	.. at ...947...
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F4761	........Ga
0FEFFFE34FEC2DDFE72F	....O.-../
E3EFE80CBFEC7FE2EFE8	..........
DEA7F337F1C5D3FE3490	...7....4.
06C5FD7FE50F7BD8DCEE	......{...
EDF6F39006FF1D4474E7	.......Dt.
BF7E59DB1B63F3FAAEFD	.~Y..c....
9294BA860810C7213FE6	.......!?.
AEFF5FAFD9FE519F4762	.._...Q.Gb
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F4763	........Gc
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F4764	........Gd
0F9006FD360000000000	....6.....
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F4765	........Ge
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F4766	........Gf
0FA7FFE5F54FE73FE725	.....O.?.%
08BFCA5FCAA5FFE57C99	..._....|.
FF99FF99AFBB6F6BF990	......ok..
067ECFB0A114820290F7	.~........
90091490061231D2C57F	......1...
25F7FBD765C996001653	%...e....S
8C2DB2DB23045900264E	.-..#.Y.&N
130A6B454500829F4767	..kEE...Gg
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F4768	........Gh
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000007F4707	........G.
FFFFFFFFFFFFFFFFFFFF	..........
FFFFFFFFFFFFFFFFFFFF	..........
FFFFFFFFFFFFFFFFFFFF	..........
FFFFFFFFFFFFFFFFFFFF	..........
FFFFFFFFFFFFFFFFFFFF	..........
FFFFFFFFFFFFFFFFFFFF	..........
FFFFFFFFFFFFFFFFFFFF	..........
FFFFFFFFFFFFFF9F4769	........Gi
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F476A	........Gj
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F476B	........Gk
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........
00FFFF90060000000000	..........
00000000000000001600	..........
00000000000000002600	........&.
000000000000009F476C	........Gl
0F900600000000000000	..........
000000FFFF9006000000	..........
00000000000000000090	..........
06000000000000000000	..........





More information about the Snort-sigs mailing list