[Snort-sigs] Fp: sig 1378

Michael Scheidell scheidell at ...249...
Sat May 13 10:33:08 EDT 2006


Fp: (just random ftp traffic with a { in it)


[snort] FTP wu-ftp bad file completion attempt {

000 : 16 03 01 00 07 0B 00 00 03 00 00 00 16 03 01 00   ................
010 : 46 10 00 00 42 00 40 15 D7 95 46 7E 85 66 F4 42   F...B. at ...3222...~.f.B
020 : F2 17 0F 41 57 F4 E0 88 F4 AB 7F 02 9C 10 09 BC   ...AW..........
030 : CD C1 9B 97 26 AB 6B EE C3 DC 2E A2 2C 7F 39 56   ....&.k.....,9V
040 : 7C B6 6A 90 C5 69 B9 2F EF D0 8A 5F AB 5D F2 53   |.j..i./..._.].S
050 : 48 99 78 DF 68 60 51 14 03 01 00 01 01 16 03 01   H.x.h`Q.........
060 : 00 30 1E 0D DB 4B 52 C1 73 DE 65 8C 4D 3D 2D 7B   .0...KR.s.e.M=-{
070 : B6 DD 04 DE FF CE 8B 2D 36 FA 7E 1E C0 97 A5 10   .......-6.~.....
080 : C5 E4 AB E0 E6 27 B3 3B 1F 25 60 E8 4A D6 7A 58   .....'.;.%`.J.zX
090 : D2 C7                                             ..


-- 
Michael Scheidell, CTO
561-999-5000, ext 1131
SECNAP Network Security Corporation
Keep up to date with latest information on IT security: Real time
security alerts: http://www.secnap.com/news
 




More information about the Snort-sigs mailing list