[Snort-users] snort attacks

Max Vision vision at ...4...
Tue May 29 17:26:08 EDT 2001


You would need to consider the context and additional details surrounding
this alert.  What service was receiving this packet (as judged by the port
numbers)?  What OS is the machine running?  What were the contents of the
packet?  Where there other probes from the same source IP that preceded
this alert, like a portmap probe?

Also what is the unicode reference, can you post the rule you used that
caused this?

Max

On Tue, 29 May 2001, Steve Moran wrote:
> Where can I find a description of the attacks or the exploit someone is
> trying to use?  For example, if I see this type of attack is occurring
> x86 NOOP - unicode BUFFER OVERFLOW ATTACK
>
> How would I know what they are trying for?
>





More information about the Snort-users mailing list