[Snort-users] IDS244 - Compaq Insight alert

Doug Lamb doug at ...517...
Tue Sep 26 15:47:07 EDT 2000


I have snort set up between our company's Internet router and our inside 
firewall.  We've gotten several hits to port 2301 within the firewall 
address pool allocated to our users.  All of these have come from port 80 
on addresses that resolve to different web sites.

IDS244  --  CVE-1999-0771 - Compaq-insight-dot-dot: 208.236.132.47:80 -> 
my.ip.address.here:2301

There seems to have been no compromise to any of our servers after getting 
these alerts.  I'm curious to know if anyone else sees this alert 
frequently, and if anyone knows of an application that would use port 2301 
besides the Compaq Insight product.  Thanks in advance.

--Doug




More information about the Snort-users mailing list