[Snort-users] What is 'SMB Name Wildcard'

David Khoury dkhoury at ...58...
Sun Aug 20 21:31:07 EDT 2000


 I went through all of this about a month ago on the Snort maillist.  The
references that I received about it were the following:

http://www.sans.org/y2k/061500.htm
http://dev.whitehats.com/IDS/177
http://dev.whitehats.com/IDS/204

 Check these out, understand what they're about, and then make up your mind
if you consider it an attack or not.

 dave

> -----Original Message-----
> From: snort-users-admin at lists.sourceforge.net
> [mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Henryk
> Plötz
> Sent: Sunday, 20 August 2000 1:27 AM
> To: 'snort-users at lists.sourceforge.net'
> Subject: [Snort-users] What is 'SMB Name Wildcard'
>
>
> Hi snorters
>
> I have a probably dumb question: What is the meaning of 'SMB Name
> Wildcard'.
> My syslog shows
>
> Aug 19 17:15:15 fuzzy snort: SMB Name Wildcard: 216.167.60.163:137 ->
> 213.21.24.185:137
>
> which is repeated around a hundred times.
> Should I regard this as an attack and inform the abuse@ or is this just
> a mistaken application.
>
> --
> Henryk Plötz            Mail: HenrykPloetz at ...348...
> Grüße von der Ostsee    Home: http://www.ploetzli.ch





More information about the Snort-users mailing list