[Snort-users] Can someone help explain this alert?

Peter Borner peter at ...3373...
Sun Sep 16 04:25:07 EDT 2001


Hi,
I'm still new to Intrusion Detection. I'd appreciate any help I can get
to understand this sequence of alerts.
Thanks,
Peter.

Generated by ACID v0.9.6b13 on Sun September 16, 2001 12:16:33
#1-1005420| [2001-09-16 04:35:11] 210.170.91.52:21 -> 62.49.145.39:21
spp_stream4: STEALTH ACTIVITY (SYN FIN scan) detection
#1-1005418| [2001-09-16 04:35:11] 210.170.91.52:21 -> 62.49.145.36:21
spp_stream4: STEALTH ACTIVITY (SYN FIN scan) detection
#1-1005419| [2001-09-16 04:35:11] 210.170.91.52:21 -> 62.49.145.37:21
spp_stream4: STEALTH ACTIVITY (SYN FIN scan) detection
#1-1005416| [2001-09-16 04:35:10] 210.170.91.52:21 -> 62.49.145.34:21
spp_stream4: STEALTH ACTIVITY (SYN FIN scan) detection
#1-1005417| [2001-09-16 04:35:11] 210.170.91.52:21 -> 62.49.145.35:21
spp_stream4: STEALTH ACTIVITY (SYN FIN scan) detection
#1-1005423| [2001-09-16 04:35:11] 210.170.91.52:21 -> 62.49.145.43:21
spp_stream4: STEALTH ACTIVITY (SYN FIN scan) detection
#1-1005422| [2001-09-16 04:35:11] 210.170.91.52:21 -> 62.49.145.41:21
spp_stream4: STEALTH ACTIVITY (SYN FIN scan) detection
#1-1005421| [2001-09-16 04:35:11] 210.170.91.52:21 -> 62.49.145.40:21
spp_stream4: STEALTH ACTIVITY (SYN FIN scan) detection






More information about the Snort-users mailing list