[Snort-users] INVALIDACK

Paul Asadoorian paul.com at ...530...
Mon May 21 12:03:38 EDT 2001


Snort Users,

I get these a few times a day, always on port 80, always destined for a
proxy server, and always with the following flags set.  I am using snort
1.7-rel.  Any help is greatly appreciated.

Paul
May 17 10:24:13 192.193.195.132:80 -> MY.NET.1.36:3012 INVALIDACK ***A*R*F
May 17 10:24:19 192.193.195.132:80 -> MY.NET.1.36:3007 INVALIDACK ***A*R*F
May 17 10:24:17 192.193.195.132:80 -> MY.NET.1.36:3022 INVALIDACK ***A*R*F
May 17 10:24:15 192.193.195.132:80 -> MY.NET.1.36:3012 INVALIDACK ***A*R*F
May 17 10:24:17 192.193.195.132:80 -> MY.NET.1.36:2983 INVALIDACK ***A*R*F
May 17 10:24:18 192.193.195.132:80 -> MY.NET.1.36:2942 INVALIDACK ***A*R*F
May 17 10:24:20 192.193.195.132:80 -> MY.NET.1.36:3012 INVALIDACK ***A*R*F
May 17 10:24:20 192.193.195.132:80 -> MY.NET.1.36:2937 INVALIDACK ***A*R*F
May 17 10:24:21 192.193.195.132:80 -> MY.NET.1.36:3022 INVALIDACK ***A*R*F
May 17 10:24:25 192.193.195.132:80 -> MY.NET.1.36:2983 INVALIDACK ***A*R*F
May 17 10:24:27 192.193.195.132:80 -> MY.NET.1.36:3007 INVALIDACK ***A*R*F
May 17 10:24:27 192.193.195.132:80 -> MY.NET.1.36:3012 INVALIDACK ***A*R*F
May 17 10:24:36 192.193.195.132:80 -> MY.NET.1.36:2937 INVALIDACK ***A*R*F
May 17 10:24:41 192.193.195.132:80 -> MY.NET.1.36:3197 INVALIDACK ***A*R*F
May 17 10:24:41 192.193.195.132:80 -> MY.NET.1.36:3198 INVALIDACK ***A*R*F
May 17 10:24:45 192.193.195.132:80 -> MY.NET.1.36:3197 INVALIDACK ***A*R*F
May 17 10:24:45 192.193.195.132:80 -> MY.NET.1.36:3198 INVALIDACK ***A*R*F
May 17 10:24:53 192.193.195.132:80 -> MY.NET.1.36:3197 INVALIDACK ***A*R*F
May 17 10:24:53 192.193.195.132:80 -> MY.NET.1.36:3198 INVALIDACK ***A*R*F





More information about the Snort-users mailing list