[Snort-users] bug?

Joe McAlerney joey at ...155...
Tue Nov 21 19:22:06 EST 2000


eziman ussr wrote:
> 
> im using the snort 1.6.3 whit 10102k.rules and i have the log
> 
> Nov 2 2  07:30:26   IDS127 - TELNET - Login Incorrect
> gutenberg.ussrback.net  23   timezero.ar-ussrlabs.com  2535
> Nov 2 2  07:31:08   IDS364 - FTP-bad-login   gutenberg.ussrback.net
> 21   timezero.ar-ussrlabs.com  2536
> 
> and is en reverse order! (target are source and source are target).
> 
> Are this a bug or missconfigured?
> 
> Thanks..
> 
> eziman.-

It looks like someone from timezero.ar-ussrlabs.com tried to telnet and
FTP to gutenberg.ussrback.net, but failed to log in.  The server
(gutenberg) sent the appropriate message back, and that's what Snort
caught.

-Joe M.

-- 
+--                            --+
| Joe McAlerney, Silicon Defense |
| http://www.silicondefense.com/ |
+--                            --+



More information about the Snort-users mailing list