[Snort-users] Unusual System Events

Rino Mardo rmardo at ...1751...
Tue Apr 10 13:31:44 EDT 2001


I'm getting this from my log:

Unusual System Events
=-=-=-=-=-=-=-=-=-=-=
Apr 10 02:02:58 hostname snort[19992]: ICMP superscan echo from windows:
+xx.xx.xx.xx -> yy.yy.yy.yy
Apr 10 02:02:58 hostname snort[19992]: ICMP Echo Reply: yy.yy.yy.yy ->
+xx.xx.xx.xx
Apr 10 02:02:59 hostname snort[19992]: ICMP superscan echo from windows:
+xx.xx.xx.xx -> yy.yy.yy.yy
Apr 10 02:02:59 hostname snort[19992]: ICMP Echo Reply: yy.yy.yy.yy ->
+xx.xx.xx.xx
Apr 10 02:02:59 hostname snort[19992]: ICMP superscan echo from windows:
+xx.xx.xx.xx -> yy.yy.yy.yy
Apr 10 02:02:59 hostname snort[19992]: ICMP Echo Reply: yy.yy.yy.yy ->
+xx.xx.xx.xx


Since I'm just starting with IDS I still can't tell if I should be worried.
All values are real.  Only ip address are sanitized.


"In God we trust, all others must submit an X.509 certificate."





More information about the Snort-users mailing list