[Snort-users] bug?

Fyodor fygrave at ...121...
Tue Nov 21 20:08:22 EST 2000


On Tue, Nov 21, 2000 at 08:40:52PM -0300, eziman ussr wrote:
> im using the snort 1.6.3 whit 10102k.rules and i have the log
> 
> Nov 2 2  07:30:26   IDS127 - TELNET - Login Incorrect
> gutenberg.ussrback.net  23   timezero.ar-ussrlabs.com  2535
> Nov 2 2  07:31:08   IDS364 - FTP-bad-login   gutenberg.ussrback.net
> 21   timezero.ar-ussrlabs.com  2536
> 
> and is en reverse order! (target are source and source are target).
> 
> 
> Are this a bug or missconfigured?
> 

Probably not a bug, if you're trying to telnet into gutenberg.ussrback.net box.
This alert is triggered by 'Login incorrect' message which is sent
from server to userbox, that's how you get these logs. :)

-- 
http://www.notlsd.net
PGP fingerprint = 56DD 1511 DDDA 56D7 99C7  B288 5CE5 A713 0969 A4D1



More information about the Snort-users mailing list