fygrave at ...121...
Tue Nov 21 20:08:22 EST 2000
On Tue, Nov 21, 2000 at 08:40:52PM -0300, eziman ussr wrote:
> im using the snort 1.6.3 whit 10102k.rules and i have the log
> Nov 2 2 07:30:26 IDS127 - TELNET - Login Incorrect
> gutenberg.ussrback.net 23 timezero.ar-ussrlabs.com 2535
> Nov 2 2 07:31:08 IDS364 - FTP-bad-login gutenberg.ussrback.net
> 21 timezero.ar-ussrlabs.com 2536
> and is en reverse order! (target are source and source are target).
> Are this a bug or missconfigured?
Probably not a bug, if you're trying to telnet into gutenberg.ussrback.net box.
This alert is triggered by 'Login incorrect' message which is sent
from server to userbox, that's how you get these logs. :)
PGP fingerprint = 56DD 1511 DDDA 56D7 99C7 B288 5CE5 A713 0969 A4D1
More information about the Snort-users