[Snort-users] chameleon overflow

Ralf Hildebrandt Ralf.Hildebrandt at ...821...
Fri Jun 8 17:00:57 EDT 2001


On Fri, Jun 08, 2001 at 01:20:57PM -0500, Matt Hand wrote:
 
>   In any case, here are the relevant lines from the log file:
What's really relevant is the packed dump itself, not the alert!

> Jun  7 16:27:05 chia snort: SMTP chameleon overflow: 206.132.30.40:41226 -> 207.252.45.6:25

Go find the packet dump for the source IP 206.132.30.40 and look into
it.

-- 
ralf.hildebrandt at ...821...                            innominate AG
Technical Consultant                   Don't be afraid of what you see -
Diplom-Informatiker                     be afraid of what you don't see!
tel: +49.(0)7000.POSTFIX                        fax: +49.(0)30.308806-77

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20010608/90a8664b/attachment.sig>


More information about the Snort-users mailing list