joey at ...155...
Tue Nov 21 19:22:06 EST 2000
eziman ussr wrote:
> im using the snort 1.6.3 whit 10102k.rules and i have the log
> Nov 2 2 07:30:26 IDS127 - TELNET - Login Incorrect
> gutenberg.ussrback.net 23 timezero.ar-ussrlabs.com 2535
> Nov 2 2 07:31:08 IDS364 - FTP-bad-login gutenberg.ussrback.net
> 21 timezero.ar-ussrlabs.com 2536
> and is en reverse order! (target are source and source are target).
> Are this a bug or missconfigured?
It looks like someone from timezero.ar-ussrlabs.com tried to telnet and
FTP to gutenberg.ussrback.net, but failed to log in. The server
(gutenberg) sent the appropriate message back, and that's what Snort
| Joe McAlerney, Silicon Defense |
| http://www.silicondefense.com/ |
More information about the Snort-users