[Snort-users] MISC IP Reserved bit set

Matthew Collins Matthew.Collins at ...1681...
Fri Oct 12 08:33:10 EDT 2001


Look at the source port. 80 -> YourIP:35434.

Been downloading some rules from the snort web site?

>>> "Frontgate Lab" <mdiwan at ...200...> 12/10/01 16:02:13 >>>
Hiya .. errm.. i think this is bad... i belive it is nimda:

Oct 11 11:48:35 fglab snort[4483]: [1:1284:3] WEB-MISC readme.eml
attempt [Classification: Attempted User Privilege Gain] [Priority: 8]:
{TCP} 151.196.107.166:80 -> 192.168.150.203:35434

nslookup results:

 nslookup 151.196.107.166
Note:  nslookup is deprecated and may be removed from future releases.
Consider using the `dig' or `host' programs instead.  Run nslookup with
the `-sil[ent]' option to prevent this message from appearing.
Server:		207.150.196.199
Address:	207.150.196.199#53

Non-authoritative answer:
166.107.196.151.in-addr.arpa	name = snort.sourcefire.com.

Authoritative answers can be found from:
166.107.196.151.in-addr.arpa	nameserver = ns1.sourcefire.com.
166.107.196.151.in-addr.arpa	nameserver = ns2.sourcefire.com.
ns1.sourcefire.com	internet address = 151.196.107.164
ns2.sourcefire.com	internet address = 151.196.107.165




****************************************************************************************
This message and any attachments are confidential to the ordinary user of
the e-mail address to which it was addressed and may also be privileged.
If you are not the addressee you may not copy, forward, disclose or use 
any part of the message or its attachments and if you have received this
message in error, please notify the sender immediately by return e-mail and
delete it from your system.
Internet communications cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, arrive late or contain
viruses. The sender therefore does not accept liability for any errors or
omissions in the context of this message which arise as a result of Internet
transmission.
Northern Registrars Limited, Northern House, Woodsome Park, Fenay 
Bridge, Huddersfield. HD8 0LA.
Tel: +44 (0) 1484 600900  Fax: +44 (0) 1484 600911
For more information visit our web site: http://www.northernregistrars.co.uk
****************************************************************************************





More information about the Snort-users mailing list