[Snort-users] snoop output contradicts with snort database
jjennings at ...4832...
Sat Feb 9 17:00:03 EST 2002
There's always 'format c:' if the beer doesn't work..
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Gongya Yu
Sent: Saturday, February 09, 2002 5:15 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] snoop output contradicts with snort database
I have a win2k box compromised. After I boot up that box, I use
snoop to find that it sends
lots of packets to remote machines on port 80 from random local ports. I
set up a snort box to plugin to oracle
database. When I query tcphdr table, I found tcp_sport contains port 80,
while tcp_dport contains random ports.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users