[Snort-users] Re: Snort-users digest, Vol 1 #2411 - 4 msgs

Mike Cole Mike.Cole at ...7283...
Thu Oct 24 12:09:19 EDT 2002


I'm out of the office until Monday the 28th.  If this is a pressing matter, please call me @ 209.569.3910 and I'll do my best to get back to you.

Mike

>>> snort-users 10/24/02 12:02 >>>

Send Snort-users mailing list submissions to
	snort-users at lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
	snort-users-request at lists.sourceforge.net

You can reach the person managing the list at
	snort-users-admin at lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."


Today's Topics:

   1. RE: Portscan 2 question (Joe Giles)
   2. Is this a valid rule? (Lefevre, Steven)
   3. Re: dual inteface? (Phil Wood)
   4. Re: Snort-users digest, Vol 1 #2410 - 3 msgs (Mike Cole)

--__--__--

Message: 1
Subject: RE: [Snort-users] Portscan 2 question
From: Joe Giles <jgiles at ...6534...>
To: "Hicks, John" <JHicks at ...5857...>
Cc: Snort-List <snort-users at lists.sourceforge.net>
Date: 24 Oct 2002 12:51:31 -0600

Well, I do use AIM. I also have a Game server running on port 27016 and
27017. 

If this is normal TCP/UDP communication, I'm OK with that. I was just
concerned that someone hacked me and was using my machine as a proxy to
attack other machines(Or at least scan other machines). But I cant see
any evidence of that. I have checked the logs, bash_history of my few
users, and a neat tool called last. I also ran a root kit check. So, at
this point, I'm pretty sure that it is just normal traffic. Just threw
me off guard cause I have never seen this before in ACID...

Thanks

Joe



On Thu, 2002-10-24 at 12:38, Hicks, John wrote:
> Instance #2 is what I was assuming your issue to be. Instance #1 imho needs
> more correlation, but given UDP and the destination port being the same, i'd
> assume maybe IM?
> 
> John
> 
> -----Original Message-----
> From: Joe Giles [mailto:jgiles at ...6534...]
> Sent: Thursday, October 24, 2002 2:26 PM
> To: Soren Macbeth
> Cc: Snort-List
> Subject: RE: [Snort-users] Portscan 2 question
> 
> 
> Here is what I found in that scan.log file for the 2 dest IP's... 
> 
> Instance 1>
> 10/17-14:29:25.712618  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 33905 dport: 27160 tgts: 10 ports: 114 event_id: 1525
> 10/18-12:05:07.946026  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 1641 dport: 27160 tgts: 9 ports: 130 event_id: 400
> 10/18-13:22:24.504843  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 2804 dport: 27160 tgts: 8 ports: 121 event_id: 433
> 10/18-13:33:27.113376  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 3782 dport: 27160 tgts: 9 ports: 139 event_id: 450
> 10/18-13:36:00.675879  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 4825 dport: 27160 tgts: 10 ports: 158 event_id: 458
> 10/18-14:52:00.545930  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 34177 dport: 27160 tgts: 7 ports: 129 event_id: 1021
> 10/18-19:04:12.292185  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 1628 dport: 27160 tgts: 10 ports: 130 event_id: 1161
> 10/19-12:38:43.719170  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 34139 dport: 27160 tgts: 9 ports: 126 event_id: 1417
> 10/19-19:16:04.828533  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 1637 dport: 27160 tgts: 11 ports: 129 event_id: 1585
> 10/19-19:41:53.321697  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 1649 dport: 27160 tgts: 10 ports: 125 event_id: 1600
> 10/19-21:13:32.829862  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 33921 dport: 27160 tgts: 11 ports: 112 event_id: 1639
> 10/22-14:51:35.899289  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
> 33952 dport: 27160 tgts: 3 ports: 21 event_id: 0
> 
> Instance 2>
> 10/23-11:17:52.681476  TCP src: <INTERNALIP> dst: 206.65.183.110 sport:
> 1097 dport: 80 tgts: 6 ports: 7 flags: ******S* event_id: 0
> 
> What do you think?
> 
> Thanks
> 
> Joe
> 
> 
> On Thu, 2002-10-24 at 12:02, Soren Macbeth wrote:
> > Looks at the ports that portscan2 reported. Sometime clients browsing
> > websites cause portscan2 to trigger based on the fact that some browsers
> > initiate a new connection (and thus, new port) for each image. If you
> > haven't change the config, there should be a scan.log file in your snort
> log
> > directory which will have more info.
> > 
> > //soren 
> > 
> > -----Original Message-----
> > From: Joe Giles [mailto:jgiles at ...6534...] 
> > Sent: Thursday, October 24, 2002 1:23 PM
> > To: Snort-List
> > Subject: [Snort-users] Portscan 2 question
> > 
> > I have a weird problem with 2 entries in my ACID database. Apparently,
> > my server did a port scan on a remote machine. The problem is that no
> > one here initiated a port scan. The database lists my server IP as the
> > source and lists a dest IP. This is listed as a spp_portscan2. Does the
> > new snort scan other machines on the Internet? I don't want any issues
> > with other services because they think I'm port scanning their network.
> > 
> > Thanks
> > 
> > Joe
> > 
> > 
> > 
> > 
> > 
> > -------------------------------------------------------
> > This sf.net email is sponsored by: Influence the future 
> > of Java(TM) technology. Join the Java Community 
> > Process(SM) (JCP(SM)) program now. 
> > http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > 
> > 
> > -------------------------------------------------------
> > This sf.net email is sponsored by: Influence the future 
> > of Java(TM) technology. Join the Java Community 
> > Process(SM) (JCP(SM)) program now. 
> > http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 
> 
> 
> -------------------------------------------------------
> This sf.net email is sponsored by: Influence the future 
> of Java(TM) technology. Join the Java Community 
> Process(SM) (JCP(SM)) program now. 
> http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




--__--__--

Message: 2
From: SLefevre at ...7076... (Lefevre, Steven)
To: "Snort-List" <snort-users at lists.sourceforge.net>
Date: Thu, 24 Oct 2002 14:52:24 -0400
Subject: [Snort-users] Is this a valid rule?

I have this rule in my local rule file:

alert tcp $EXTERNAL_NET any -> $HOME_NET 6008:6009 (msg:"IRC Activity")

(It's to detect IRC traffic ;)

Why does snort always choke on it? I've looked it over 100 times and it
seems to follow the syntax.



--__--__--

Message: 3
From: Phil Wood <cpw at ...440...>
Date: Thu, 24 Oct 2002 13:00:30 -0600
To: Daniel Curry <dcurry at ...5551...>
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] dual inteface?

If you have an os and pcap that supports the "any" interface, then you could:

  snort ... -i any ...

This may not be what you want since you get all the interfaces on your box.

I found that it did not appear to work with shared libraries (but
that might be due to some funny stuff on my end).  So, I built a
static snort.  (add -static to LDFLAGS and reload, might need -lz at
tail end of load line).

On Thu, Oct 24, 2002 at 08:28:04AM -0700, Daniel Curry wrote:
>  I had lost the email that gave information
> on how to configure snort to see two, eth2 and eth3,
> promicus interfaces on a redhat 7.2 system?
>  I did not see the information in http://sourceforge.net/mailarchive.
> Thank you.
>  
> -- 
> Daniel Curry
> DIRECT 650-232-4006
> FAX 650-232-3200
> PGP AD5A 96DC 7556 A020 B8E7  0E4D 5D5E 9BA5 C83E 8C92
> 
> 
> -------------------------------------------------------
> This sf.net email is sponsored by: Influence the future 
> of Java(TM) technology. Join the Java Community 
> Process(SM) (JCP(SM)) program now. 
> http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javavote
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Phil Wood, cpw at ...440...



--__--__--

Message: 4
Date: Thu, 24 Oct 2002 12:05:10 -0700
From: "Mike Cole" <Mike.Cole at ...7283...>
Reply-To: Mike.Cole at ...7283...
To: <snort-users at lists.sourceforge.net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2410 - 3 msgs

I'm out of the office until Monday the 28th.  If this is a pressing =
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
you.

Mike

>>> snort-users 10/24/02 11:51 >>>

Send Snort-users mailing list submissions to
	snort-users at lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
	snort-users-request at lists.sourceforge.net

You can reach the person managing the list at
	snort-users-admin at lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."


Today's Topics:

   1. RE: Portscan 2 question (Hicks, John)
   2. Snort 1.9.0 on Windows and MSSQL (Robbins, Mark)
   3. Re: Snort-users digest, Vol 1 #2409 - 1 msg (Mike Cole)

-- __--__-- 

Message: 1
From: "Hicks, John" <JHicks at ...5857...>
To: 'Joe Giles' <jgiles at ...6534...>
Cc: "Snort Users (E-mail)" <snort-users at lists.sourceforge.net>
Subject: RE: [Snort-users] Portscan 2 question
Date: Thu, 24 Oct 2002 14:33:24 -0400

it's 'last' and again, *any* service allowing ephemeral ports may cause =
this
not just DNS.

cheers,
John

-----Original Message-----
From: Joe Giles [mailto:jgiles at ...6534...]
Sent: Thursday, October 24, 2002 2:13 PM
To: Robby Desmond
Cc: Snort-List
Subject: Re: [Snort-users] Portscan 2 question


Well, I'm not RUNNING a DNS server, but I use one. My ISP's DNS...
Should I add that to the list?=20

Also, I don't seem to have the 'lasts' command. What package is that
part of?

Thanks for the reply

Joe

On Thu, 2002-10-24 at 12:03, Robby Desmond wrote:
> At 11:22 AM 10/24/02 -0600, you wrote:
> >I have a weird problem with 2 entries in my ACID database. Apparently,
> >my server did a port scan on a remote machine. The problem is that no
> >one here initiated a port scan. The database lists my server IP as the
> >source and lists a dest IP. This is listed as a spp_portscan2. Does the
> >new snort scan other machines on the Internet? I don't want any issues
> >with other services because they think I'm port scanning their network.
> >
> >Thanks
> >
> >Joe
>=20
> Are you, by chance, running DNS?
>=20
> You should add your DNS servers to the list of portscan2-ignorehosts,=20
> otherwise you will get this sort of activity.
>=20
> If you are not running DNS, then check the "lasts" command to see who =
has=20
> been on your system. (Or who has been appearing as someone on your
system.)
>=20
> -Robby
>=20
> Robert Desmond
> Systems Administrator
> UCSB Extended Learning Services
> 805-893-4906




-------------------------------------------------------
This sf.net email is sponsored by: Influence the future=20
of Java(TM) technology. Join the Java Community=20
Process(SM) (JCP(SM)) program now.=20
http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=3Dsnort-users


-- __--__-- 

Message: 2
From: "Robbins, Mark" <MRobbins at ...3937...>
To: snort-users at lists.sourceforge.net
Date: Thu, 24 Oct 2002 13:43:46 -0500
Subject: [Snort-users] Snort 1.9.0 on Windows and MSSQL

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=3D_NextPart_001_01C27B8D.48E86470
Content-Type: text/plain

Has anyone gotten Snort 1.9.0 to log to an MSSQL database with the =
available
(compiled) executables?

I am getting the error message=20

database: SQL Server message 156, state 1, severity 15:
Incorrect syntax near the keyword 'schema'.
database: The above error was caused by the following statement:
SELECT vseq FROM schema

In MSSQL, schema is a reserved word, and the syntax would have to be =
SELECT
vseq FROM [schema] for this to work. I have used previous versions of =
snort
to log to MSSQL with no difficulty.

Could this problem arise from a configuration mistake I have made, or is =
the
problem in snort.exe itself?

Thanks for any help you can provide.

Mark Robbins


------_=3D_NextPart_001_01C27B8D.48E86470
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D3D"Content-Type" CONTENT=3D3D"text/html; =3D
charset=3D3Dus-ascii">
<META NAME=3D3D"Generator" CONTENT=3D3D"MS Exchange Server version =3D
5.5.2653.12">
<TITLE>Snort 1.9.0 on Windows and MSSQL</TITLE>
</HEAD>
<BODY>

<P><FONT SIZE=3D3D2 FACE=3D3D"Arial">Has anyone gotten Snort 1.9.0 to log =
=3D
to an MSSQL database with the available (compiled) executables?</FONT>
</P>

<P><FONT SIZE=3D3D2 FACE=3D3D"Arial">I am getting the error message =
</FONT>
</P>

<P><FONT SIZE=3D3D2 FACE=3D3D"Arial">database: SQL Server message 156, =3D
state 1, severity 15:<BR>
Incorrect syntax near the keyword 'schema'.</FONT>
<BR><FONT SIZE=3D3D2 FACE=3D3D"Arial">database: The above error was caused =
=3D
by the following statement:<BR>
SELECT vseq FROM schema</FONT>
</P>

<P><FONT SIZE=3D3D2 FACE=3D3D"Arial">In MSSQL, schema is a reserved word, =
=3D
and the syntax would have to be SELECT vseq FROM [schema] for this to =3D
work. I have used previous versions of snort to log to MSSQL with no =3D
difficulty.</FONT></P>

<P><FONT SIZE=3D3D2 FACE=3D3D"Arial">Could this problem arise from a =3D
configuration mistake I have made, or is the problem in snort.exe =3D
itself?</FONT>
</P>

<P><FONT SIZE=3D3D2 FACE=3D3D"Arial">Thanks for any help you can =3D
provide.</FONT>
</P>

<P><FONT SIZE=3D3D2 FACE=3D3D"Arial">Mark Robbins</FONT>
</P>

</BODY>
</HTML>
------_=3D_NextPart_001_01C27B8D.48E86470--


-- __--__-- 

Message: 3
Date: Thu, 24 Oct 2002 11:54:27 -0700
From: "Mike Cole" <Mike.Cole at ...7283...>
Reply-To: Mike.Cole at ...7283...
To: <snort-users at lists.sourceforge.net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2409 - 1 msg

I'm out of the office until Monday the 28th.  If this is a pressing =3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
you.

Mike

>>> snort-users 10/24/02 11:43 >>>

Send Snort-users mailing list submissions to
	snort-users at lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
	snort-users-request at lists.sourceforge.net

You can reach the person managing the list at
	snort-users-admin at lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."


Today's Topics:

   1. Re: Snort-users digest, Vol 1 #2408 - 3 msgs (Mike Cole)

--  __--__-- =20

Message: 1
Date: Thu, 24 Oct 2002 11:46:29 -0700
From: "Mike Cole" <Mike.Cole at ...7283...>
Reply-To: Mike.Cole at ...7283...
To: <snort-users at lists.sourceforge.net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2408 - 3 msgs

I'm out of the office until Monday the 28th.  If this is a pressing =3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
you.

Mike

>>> snort-users 10/24/02 11:36 >>>

Send Snort-users mailing list submissions to
	snort-users at lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
	snort-users-request at lists.sourceforge.net

You can reach the person managing the list at
	snort-users-admin at lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."


Today's Topics:

   1. Re: Snort-users digest, Vol 1 #2407 - 12 msgs (Mike Cole)
   2. RE: Portscan 2 question (Soren Macbeth)
   3. Re: Portscan 2 question (Gary Verhulp)

--   __--__--  =3D20

Message: 1
Date: Thu, 24 Oct 2002 11:36:47 -0700
From: "Mike Cole" <Mike.Cole at ...7283...>
Reply-To: Mike.Cole at ...7283...
To: <snort-users at lists.sourceforge.net>
Subject: [Snort-users] Re: Snort-users digest, Vol 1 #2407 - 12 msgs

I'm out of the office until Monday the 28th.  If this is a pressing =
=3D3D3D
matter, please call me @ 209.569.3910 and I'll do my best to get back to =
=3D
=3D3D
=3D3D3D
you.

Mike

>>> snort-users 10/24/02 11:26 >>>

Send Snort-users mailing list submissions to
	snort-users at lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
	snort-users-request at lists.sourceforge.net

You can reach the person managing the list at
	snort-users-admin at lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."


Today's Topics:

   1. RE: UDP packet supposedly DROPped, but seen by snor
       t anyway (Matt Yackley)
   2. RE: UDP packet supposedly DROPped, but seen by snort anyway (Jan =3D
=3D3D3D
Ploski)
   3. RE: PROBLEMAS (Kreimendahl, Chad J)
   4. Portscan 2 question (Joe Giles)
   5. Re: dual inteface? (Bennett Todd)
   6. RE: Portscan 2 question (Joe Giles)
   7. RE: Portscan 2 question (Soren Macbeth)
   8. Re: Portscan 2 question (Joe Giles)
   9. Re: Portscan 2 question (Joe Giles)
  10. Re: Portscan 2 question (Joe Giles)
  11. RE: Portscan 2 question (Joe Giles)

--    __--__--   =3D3D20

Message: 1
From: Matt Yackley <Matt.Yackley at ...5858...>
To: 'Jan Ploski' <jpljpl at ...348...>, snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] UDP packet supposedly DROPped, but seen by snor
	t anyway
Date: Thu, 24 Oct 2002 11:23:35 -0500

Jan, it sounds like you are running Snort on the iptables box, AFAIK =
=3D3D3D
libpcap
grabs the packet when it hits the NIC, iptables is rejecting the packet =
=3D
=3D3D
=3D3D3D
but
that happens at a higher level than libpcap & snort work at. =3D3D3D20
Others here will expand more but my guess as to why the TCP is not picked =
=3D
=3D3D
=3D3D3D
up
by snort is due to the way the rules are written and the way TCP connection=
=3D
=3D3D
=3D3D3D
s
are handled.  Most rules for TCP type connections will require a 3way
handshake to be completed before something like a cmd.exe attempt is sent.
If this type of connection is blocked at the start it never gets to the
point of sending a packet that triggers the rule.  This UDP rule will
trigger with the first packet sent since it does not need a 3 way =3D3D3D
handshake
to be completed.

Anyway, that is my quick stab at this, everyone else please feel free to
correct me where I am wrong :)

Matt

-----Original Message-----
From: Jan Ploski [mailto:jpljpl at ...348...]
Sent: Thursday, October 24, 2002 10:23 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] UDP packet supposedly DROPped, but seen by snort
anyway


Hello,

I have the following rule in my Linux iptables configuration:

iptables -A block -m state --state NEW -p udp --dport 161 -j DROP

Basically, I want to ignore any traffic to UDP port 161. This rule
seems to work okay, i.e. it fires when a packet is sent to the said
port and the packet is never received by the process listening on
that port.

However, when I run snort in sniffer mode, I can see the packet
coming. It also triggers an alert (false positive in this case)
according to configured snort rules.

My question is, why can this UDP packet, supposedly already dropped
by the firewall, be sniffed at? This is not the case for any TCP
packets that have been DROPped.

Best regards -
Jan Ploski



-------------------------------------------------------
This sf.net email is sponsored by: Influence the future=3D3D3D20
of Java(TM) technology. Join the Java Community=3D3D3D20
Process(SM) (JCP(SM)) program now.=3D3D3D20
http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javavote=
=3D
=3D3D
=3D3D3D

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3Dsnort-users


--    __--__--   =3D3D20

Message: 2
Date: Thu, 24 Oct 2002 18:41:34 +0200 (CEST)
From: Jan Ploski <jpljpl at ...348...>
To: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] UDP packet supposedly DROPped, but seen by =3D
=3D3D3D
snort anyway

On Thu, Oct 24, 2002 at 11:23:35AM -0500, Matt Yackley wrote:
> Jan, it sounds like you are running Snort on the iptables box, AFAIK =3D
=3D3D3D
libpcap
> grabs the packet when it hits the NIC, iptables is rejecting the packet =
=3D
=3D3D
=3D3D3D
but
> that happens at a higher level than libpcap & snort work at. =3D3D3D20
> Others here will expand more but my guess as to why the TCP is not =
=3D3D3D
picked up
> by snort is due to the way the rules are written and the way TCP =3D3D3D
connections
> are handled.  Most rules for TCP type connections will require a 3way
> handshake to be completed before something like a cmd.exe attempt is =3D
=3D3D3D
sent.
> If this type of connection is blocked at the start it never gets to the
> point of sending a packet that triggers the rule.  This UDP rule will
> trigger with the first packet sent since it does not need a 3 way =
=3D3D3D
handshake
> to be completed.
>=3D3D3D20
> Anyway, that is my quick stab at this, everyone else please feel free to
> correct me where I am wrong :)

Matt,

you are entirely correct, and I have also received similiar suggestions
from other people on this list via private email (thanks again!).
The TCP SYN packet used to establish a connection indeed makes it
through to snort, much like the UDP packet. Too bad I did not check
this before posting... :-(

As someone else suggested: "write a pass rule for it or you can
use a bpf filter (not udp port 161) to ignore the traffic". This is
indeed a good solution, as I know that port 161 is closed on the
monitored box.

Best regards -
Jan Ploski



--    __--__--   =3D3D20

Message: 3
Subject: RE: [Snort-users] PROBLEMAS
Date: Thu, 24 Oct 2002 11:46:53 -0500
From: "Kreimendahl, Chad J" <Chad.Kreimendahl at ...4716...>
To: "Mario Alberto Soto Cordones" <mario_soto at ...7276...>,
   <snort-users at lists.sourceforge.net>


You may have to translate this back to spanish, 'cause my answer is
gonna be in english.

1.  Do you have the database tables set up for postgresql?
2.  When snort starts, do you see a connection made to the database?
3.  If no: Have you configured in snort.conf "output database
postgresql: ....."?

-----Original Message-----
From: Mario Alberto Soto Cordones [mailto:mario_soto at ...7276...]=3D3D3D3D2=
0
Sent: Thursday, October 24, 2002 1:09 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] PROBLEMAS


Tengo instalado snort en un RH 8.0, y quiero enviar los logs a una base
de=3D3D3D3D20
datos postgresql para que interactue con acid.

Mi problema es que no se llena la base de datos con los alert del snort.

Ayudenme porfavor.





-------------------------------------------------------
This sf.net email is sponsored by: Influence the future=3D3D3D3D20
of Java(TM) technology. Join the Java Community=3D3D3D3D20
Process(SM) (JCP(SM)) program now.=3D3D3D3D20
http://ad.doubleclick.net/clk;4729346;7592162;s?http://www.sun.com/javav
ote
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3D3Dsnort-users


--    __--__--   =3D3D20

Message: 4
From: Joe Giles <jgiles at ...6534...>
To: Snort-List <snort-users at lists.sourceforge.net>
Date: 24 Oct 2002 11:22:36 -0600
Subject: [Snort-users] Portscan 2 question

I have a weird problem with 2 entries in my ACID database. Apparently,
my server did a port scan on a remote machine. The problem is that no
one here initiated a port scan. The database lists my server IP as the
source and lists a dest IP. This is listed as a spp_portscan2. Does the
new snort scan other machines on the Internet? I don't want any issues
with other services because they think I'm port scanning their network.

Thanks

Joe





--    __--__--   =3D3D20

Message: 5
Date: Thu, 24 Oct 2002 13:28:44 -0400
From: Bennett Todd <bet at ...6163...>
To: Daniel Curry <dcurry at ...5551...>
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] dual inteface?


--4zI0WCX1RcnW9Hbu
Content-Type: text/plain; charset=3D3D3D3Dus-ascii
Content-Disposition: inline

2002-10-24-11:28:04 Daniel Curry:
>  I had lost the email that gave information
> on how to configure snort to see two, eth2 and eth3,
> promicus interfaces on a redhat 7.2 system?

I think you're perhaps talking about this?

---------------------------------------------------------------------------=
=3D
=3D3D
=3D3D3D
---

Version 1.2 --- that promisc is only needed on the bond0 interface

Version 1.1 --- need to explicitly "promisc" on the ifconfigs;
	snort's putting the -i bond0 into promisc didn't propogate
	back through to the underlying eth interfaces.

---------------------------------------------------------------------------=
=3D
=3D3D
=3D3D3D
---

In Red Hat 7.3, with the default 2.4.18-3 kernel, it's really easy
to bond multiple channels to snort them all. The technique is
documented in /usr/src/linux/Documentation/networking/bonding.txt.
In brief:

	grep bond0 /etc/modules.conf || echo alias bond0 bonding >/etc/modu=
=3D
=3D3D
=3D3D3D
les.conf
	ifconfig bond0 promisc up
	for if in eth1 eth2 ...;do
		ifconfig $if up
		ifenslave bond0 $if
	done
	snort ... -i bond0 ...

Works great. The ifenslave invocations whinge a bit about all the
things they can't do with the unnumbered interfaces, but it all
works.

I used 3 Compaq DL-320s for a test setup. Each of these comes with
two eepro100 interfaces; in one I've added a third such interface in
the PCI slot. On each box the eth0 is the mgmt interface (NB when
you add a PCI card eepro100 it becomes eth0 and the two builtin NICs
renumber to eth1 and eth2).

Besides running the eth0 interfaces to a hub, I tied the two eth1s
from the dual-interface traffic generators to the eth1 and eth2
builtins on the 3-interface box, with crossover cables, running
100BaseT. I used the above invocations to get snort cooking with
its default sigs, listening to bond0 with eth1 and eth2 enslaved to
it. Snort sat idle. I fired up a ping -f on one of the generators
and snort jumped up to 25% CPU; then launched ping -f on the
other generator and it jumped to 55%. Each generator was emitting
c. 20,000 packets/second, default ping packet size (64 bytes).

When I next tried tcpreplay[1], all was not as happy, until I
stumbled across the above-mentioned need to promisc the bond0
interface manually as you're ifconfigging it. Actually, what I first
did was ifconfig both the bond0 and the underlying eth# interfaces
promisc; that worked too, but was overkill. When I inquired about
this matter on the bonding-devel mailing list, they explained to me
that flags like promisc _Are_ propogated down to the underlying
interfaces, but only at ifenslave time, not later.

Once I got that, things got lots more better. Do remember when
benchmarking with tcpreplay to make sure to tcpdump -s 0, so you
aren't using captures with truncated packets.

-Bennett

[1] <URL:http://tcpreplay.sf.net/>

--4zI0WCX1RcnW9Hbu
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9uC3MHZWg9mCTffwRAgl4AJwPNKA0sb29K5VdNH1tkjtNeN262gCdEHIT
goT0xSBgTN0XxdUVPXyXAyQ=3D3D3D3D
=3D3D3D3DSRdE
-----END PGP SIGNATURE-----

--4zI0WCX1RcnW9Hbu--


--    __--__--   =3D3D20

Message: 6
Subject: RE: [Snort-users] Portscan 2 question
From: Joe Giles <jgiles at ...6534...>
To: "Hicks, John" <JHicks at ...5857...>
Cc: Snort-List <snort-users at lists.sourceforge.net>
Date: 24 Oct 2002 11:54:41 -0600

Wheew... I though I was hacked or something. I thought some one was
using my server as a proxy to scan other networks :-P

I'm not sure how to alleviate this problem, but maybe the Snort guru's
can figure it out :)

Thanks

Joe

On Thu, 2002-10-24 at 11:46, Hicks, John wrote:
> I'm noticing the same thing after instaling 1.9 on a Web Server. It =3D
=3D3D3D
seems to
> detect my $HOME_NET address replying to multiple web requests on various
> ephemeral ports as a portscan. any thoughts on how to control this? I =
=3D
=3D3D
=3D3D3D
tried
> the ignorehosts to no avail :(
>=3D3D3D20
> John
>=3D3D3D20
> -----Original Message-----
> From: Joe Giles [mailto:jgiles at ...6534...]
> Sent: Thursday, October 24, 2002 1:23 PM
> To: Snort-List
> Subject: [Snort-users] Portscan 2 question
>=3D3D3D20
>=3D3D3D20
> I have a weird problem with 2 entries in my ACID database. Apparently,
> my server did a port scan on a remote machine. The problem is that no
> one here initiated a port scan. The database lists my server IP as the
> source and lists a dest IP. This is listed as a spp_portscan2. Does the
> new snort scan other machines on the Internet? I don't want any issues
> with other services because they think I'm port scanning their network.
>=3D3D3D20
> Thanks
>=3D3D3D20
> Joe
>=3D3D3D20
>=3D3D3D20
>=3D3D3D20
>=3D3D3D20
>=3D3D3D20
> -------------------------------------------------------
> This sf.net email is sponsored by: Influence the future=3D3D3D20
> of Java(TM) technology. Join the Java Community=3D3D3D20
> Process(SM) (JCP(SM)) program now.=3D3D3D20
> http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3Dsnort-users




--    __--__--   =3D3D20

Message: 7
From: Soren Macbeth <smacbeth at ...7281...>
To: Snort-List <snort-users at lists.sourceforge.net>
Subject: RE: [Snort-users] Portscan 2 question
Date: Thu, 24 Oct 2002 14:02:40 -0400

Looks at the ports that portscan2 reported. Sometime clients browsing
websites cause portscan2 to trigger based on the fact that some browsers
initiate a new connection (and thus, new port) for each image. If you
haven't change the config, there should be a scan.log file in your snort =
=3D
=3D3D
=3D3D3D
log
directory which will have more info.

//soren=3D3D3D20

-----Original Message-----
From: Joe Giles [mailto:jgiles at ...6534...]=3D3D3D20
Sent: Thursday, October 24, 2002 1:23 PM
To: Snort-List
Subject: [Snort-users] Portscan 2 question

I have a weird problem with 2 entries in my ACID database. Apparently,
my server did a port scan on a remote machine. The problem is that no
one here initiated a port scan. The database lists my server IP as the
source and lists a dest IP. This is listed as a spp_portscan2. Does the
new snort scan other machines on the Internet? I don't want any issues
with other services because they think I'm port scanning their network.

Thanks

Joe





-------------------------------------------------------
This sf.net email is sponsored by: Influence the future=3D3D3D20
of Java(TM) technology. Join the Java Community=3D3D3D20
Process(SM) (JCP(SM)) program now.=3D3D3D20
http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3Dsnort-users


--    __--__--   =3D3D20

Message: 8
Subject: Re: [Snort-users] Portscan 2 question
From: Joe Giles <jgiles at ...6534...>
To: Robby Desmond <rdesmond at ...6547...>
Cc: Snort-List <snort-users at lists.sourceforge.net>
Date: 24 Oct 2002 12:12:44 -0600

Well, I'm not RUNNING a DNS server, but I use one. My ISP's DNS...
Should I add that to the list?=3D3D3D20

Also, I don't seem to have the 'lasts' command. What package is that
part of?

Thanks for the reply

Joe

On Thu, 2002-10-24 at 12:03, Robby Desmond wrote:
> At 11:22 AM 10/24/02 -0600, you wrote:
> >I have a weird problem with 2 entries in my ACID database. Apparently,
> >my server did a port scan on a remote machine. The problem is that no
> >one here initiated a port scan. The database lists my server IP as the
> >source and lists a dest IP. This is listed as a spp_portscan2. Does the
> >new snort scan other machines on the Internet? I don't want any issues
> >with other services because they think I'm port scanning their network.
> >
> >Thanks
> >
> >Joe
>=3D3D3D20
> Are you, by chance, running DNS?
>=3D3D3D20
> You should add your DNS servers to the list of portscan2-ignorehosts,=3D3=
D3=3D
D2=3D3D
0
> otherwise you will get this sort of activity.
>=3D3D3D20
> If you are not running DNS, then check the "lasts" command to see who =
=3D
=3D3D
=3D3D3D
has=3D3D3D20
> been on your system. (Or who has been appearing as someone on your =
=3D3D3D
system.)
>=3D3D3D20
> -Robby
>=3D3D3D20
> Robert Desmond
> Systems Administrator
> UCSB Extended Learning Services
> 805-893-4906




--    __--__--   =3D3D20

Message: 9
Subject: Re: [Snort-users] Portscan 2 question
From: Joe Giles <jgiles at ...6534...>
To: Robby Desmond <rdesmond at ...6547...>
Cc: Snort-List <snort-users at lists.sourceforge.net>
Date: 24 Oct 2002 12:15:54 -0600

I also checked the history files of the 5 users I do have and nothing in
there indicates that nmap or nessus or any other scanner was ran. And
there was no sudo or su command initiated.=3D3D3D20

Thanks

Joe

On Thu, 2002-10-24 at 12:03, Robby Desmond wrote:
> At 11:22 AM 10/24/02 -0600, you wrote:
> >I have a weird problem with 2 entries in my ACID database. Apparently,
> >my server did a port scan on a remote machine. The problem is that no
> >one here initiated a port scan. The database lists my server IP as the
> >source and lists a dest IP. This is listed as a spp_portscan2. Does the
> >new snort scan other machines on the Internet? I don't want any issues
> >with other services because they think I'm port scanning their network.
> >
> >Thanks
> >
> >Joe
>=3D3D3D20
> Are you, by chance, running DNS?
>=3D3D3D20
> You should add your DNS servers to the list of portscan2-ignorehosts,=3D3=
D3=3D
D2=3D3D
0
> otherwise you will get this sort of activity.
>=3D3D3D20
> If you are not running DNS, then check the "lasts" command to see who =
=3D
=3D3D
=3D3D3D
has=3D3D3D20
> been on your system. (Or who has been appearing as someone on your =
=3D3D3D
system.)
>=3D3D3D20
> -Robby
>=3D3D3D20
> Robert Desmond
> Systems Administrator
> UCSB Extended Learning Services
> 805-893-4906




--    __--__--   =3D3D20

Message: 10
Subject: Re: [Snort-users] Portscan 2 question
From: Joe Giles <jgiles at ...6534...>
To: Robby Desmond <rdesmond at ...6547...>
Cc: Snort-List <snort-users at lists.sourceforge.net>
Date: 24 Oct 2002 12:21:58 -0600

Hay, that is a neat command :).=3D3D3D20

Well, according to last, no one logged on but me during the time of the
"Issue".=3D3D3D20

Thanks. I will add my ISP's DNS to the list and see if that helps. This
is the first time I have seen this message in ACID since I upgraded to
the new snort. That was better than a week ago.

Thanks

Joe

On Thu, 2002-10-24 at 12:16, Robby Desmond wrote:
> At 12:12 PM 10/24/02 -0600, you wrote:
> >Well, I'm not RUNNING a DNS server, but I use one. My ISP's DNS...
> >Should I add that to the list?
>=3D3D3D20
> Yes. That will reduce your portscan alerts, but doesn't solve the =
=3D3D3D
problem=3D3D3D20
> of your host causing portscan alerts.
>=3D3D3D20
> >Also, I don't seem to have the 'lasts' command. What package is that
> >part of?
>=3D3D3D20
> Oops. Make that singular "last".  It is a standard UNIX tool.
>=3D3D3D20
> >Thanks for the reply
> >
> >Joe
>=3D3D3D20
> No prob.
>=3D3D3D20
> You might also want to check to see if any of the services you run =
=3D3D3D
from=3D3D3D20
> your server periodically scan hosts for some reason.
>=3D3D3D20
> HTH,
> -Robby
>=3D3D3D20
> Robert Desmond
> Systems Administrator
> UCSB Extended Learning Services
> 805-893-4906




--    __--__--   =3D3D20

Message: 11
Subject: RE: [Snort-users] Portscan 2 question
From: Joe Giles <jgiles at ...6534...>
To: Soren Macbeth <smacbeth at ...7281...>
Cc: Snort-List <snort-users at lists.sourceforge.net>
Date: 24 Oct 2002 12:26:18 -0600

Here is what I found in that scan.log file for the 2 dest IP's...=3D3D3D20

Instance 1>
10/17-14:29:25.712618  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
33905 dport: 27160 tgts: 10 ports: 114 event_id: 1525
10/18-12:05:07.946026  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
1641 dport: 27160 tgts: 9 ports: 130 event_id: 400
10/18-13:22:24.504843  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
2804 dport: 27160 tgts: 8 ports: 121 event_id: 433
10/18-13:33:27.113376  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
3782 dport: 27160 tgts: 9 ports: 139 event_id: 450
10/18-13:36:00.675879  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
4825 dport: 27160 tgts: 10 ports: 158 event_id: 458
10/18-14:52:00.545930  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
34177 dport: 27160 tgts: 7 ports: 129 event_id: 1021
10/18-19:04:12.292185  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
1628 dport: 27160 tgts: 10 ports: 130 event_id: 1161
10/19-12:38:43.719170  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
34139 dport: 27160 tgts: 9 ports: 126 event_id: 1417
10/19-19:16:04.828533  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
1637 dport: 27160 tgts: 11 ports: 129 event_id: 1585
10/19-19:41:53.321697  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
1649 dport: 27160 tgts: 10 ports: 125 event_id: 1600
10/19-21:13:32.829862  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
33921 dport: 27160 tgts: 11 ports: 112 event_id: 1639
10/22-14:51:35.899289  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
33952 dport: 27160 tgts: 3 ports: 21 event_id: 0

Instance 2>
10/23-11:17:52.681476  TCP src: <INTERNALIP> dst: 206.65.183.110 sport:
1097 dport: 80 tgts: 6 ports: 7 flags: ******S* event_id: 0

What do you think?

Thanks

Joe


On Thu, 2002-10-24 at 12:02, Soren Macbeth wrote:
> Looks at the ports that portscan2 reported. Sometime clients browsing
> websites cause portscan2 to trigger based on the fact that some browsers
> initiate a new connection (and thus, new port) for each image. If you
> haven't change the config, there should be a scan.log file in your snort =
=3D
=3D3D
=3D3D3D
log
> directory which will have more info.
>=3D3D3D20
> //soren=3D3D3D20
>=3D3D3D20
> -----Original Message-----
> From: Joe Giles [mailto:jgiles at ...6534...]=3D3D3D20
> Sent: Thursday, October 24, 2002 1:23 PM
> To: Snort-List
> Subject: [Snort-users] Portscan 2 question
>=3D3D3D20
> I have a weird problem with 2 entries in my ACID database. Apparently,
> my server did a port scan on a remote machine. The problem is that no
> one here initiated a port scan. The database lists my server IP as the
> source and lists a dest IP. This is listed as a spp_portscan2. Does the
> new snort scan other machines on the Internet? I don't want any issues
> with other services because they think I'm port scanning their network.
>=3D3D3D20
> Thanks
>=3D3D3D20
> Joe
>=3D3D3D20
>=3D3D3D20
>=3D3D3D20
>=3D3D3D20
>=3D3D3D20
> -------------------------------------------------------
> This sf.net email is sponsored by: Influence the future=3D3D3D20
> of Java(TM) technology. Join the Java Community=3D3D3D20
> Process(SM) (JCP(SM)) program now.=3D3D3D20
> http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3Dsnort-users
>=3D3D3D20
>=3D3D3D20
> -------------------------------------------------------
> This sf.net email is sponsored by: Influence the future=3D3D3D20
> of Java(TM) technology. Join the Java Community=3D3D3D20
> Process(SM) (JCP(SM)) program now.=3D3D3D20
> http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=3D3D3D3Dsnort-users





--    __--__--   =3D3D20

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-users


End of Snort-users Digest



--   __--__--  =3D20

Message: 2
From: Soren Macbeth <smacbeth at ...7281...>
To: 'Joe Giles' <jgiles at ...6534...>, Soren Macbeth
	 <smacbeth at ...7281...>
Cc: Snort-List <snort-users at lists.sourceforge.net>
Subject: RE: [Snort-users] Portscan 2 question
Date: Thu, 24 Oct 2002 14:32:59 -0400

I'm not sure about the udp dport 27160 stuff. Are you running some
application on that port? Its all traffic to on particular host. You may
want to check into that.

The second one is definitely benign web browsing.

//soren


-----Original Message-----
From: Joe Giles [mailto:jgiles at ...6534...]=3D3D20
Sent: Thursday, October 24, 2002 2:26 PM
To: Soren Macbeth
Cc: Snort-List
Subject: RE: [Snort-users] Portscan 2 question

Here is what I found in that scan.log file for the 2 dest IP's...=3D3D20

Instance 1>
10/17-14:29:25.712618  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
33905 dport: 27160 tgts: 10 ports: 114 event_id: 1525
10/18-12:05:07.946026  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
1641 dport: 27160 tgts: 9 ports: 130 event_id: 400
10/18-13:22:24.504843  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
2804 dport: 27160 tgts: 8 ports: 121 event_id: 433
10/18-13:33:27.113376  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
3782 dport: 27160 tgts: 9 ports: 139 event_id: 450
10/18-13:36:00.675879  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
4825 dport: 27160 tgts: 10 ports: 158 event_id: 458
10/18-14:52:00.545930  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
34177 dport: 27160 tgts: 7 ports: 129 event_id: 1021
10/18-19:04:12.292185  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
1628 dport: 27160 tgts: 10 ports: 130 event_id: 1161
10/19-12:38:43.719170  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
34139 dport: 27160 tgts: 9 ports: 126 event_id: 1417
10/19-19:16:04.828533  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
1637 dport: 27160 tgts: 11 ports: 129 event_id: 1585
10/19-19:41:53.321697  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
1649 dport: 27160 tgts: 10 ports: 125 event_id: 1600
10/19-21:13:32.829862  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
33921 dport: 27160 tgts: 11 ports: 112 event_id: 1639
10/22-14:51:35.899289  UDP src: <INTERNALIP> dst: 207.19.97.119 sport:
33952 dport: 27160 tgts: 3 ports: 21 event_id: 0

Instance 2>
10/23-11:17:52.681476  TCP src: <INTERNALIP> dst: 206.65.183.110 sport:
1097 dport: 80 tgts: 6 ports: 7 flags: ******S* event_id: 0

What do you think?

Thanks

Joe


On Thu, 2002-10-24 at 12:02, Soren Macbeth wrote:
> Looks at the ports that portscan2 reported. Sometime clients browsing
> websites cause portscan2 to trigger based on the fact that some browsers
> initiate a new connection (and thus, new port) for each image. If you
> haven't change the config, there should be a scan.log file in your snort
log
> directory which will have more info.
>=3D3D20
> //soren=3D3D20
>=3D3D20
> -----Original Message-----
> From: Joe Giles [mailto:jgiles at ...6534...]=3D3D20
> Sent: Thursday, October 24, 2002 1:23 PM
> To: Snort-List
> Subject: [Snort-users] Portscan 2 question
>=3D3D20
> I have a weird problem with 2 entries in my ACID database. Apparently,
> my server did a port scan on a remote machine. The problem is that no
> one here initiated a port scan. The database lists my server IP as the
> source and lists a dest IP. This is listed as a spp_portscan2. Does the
> new snort scan other machines on the Internet? I don't want any issues
> with other services because they think I'm port scanning their network.
>=3D3D20
> Thanks
>=3D3D20
> Joe
>=3D3D20
>=3D3D20
>=3D3D20
>=3D3D20
>=3D3D20
> -------------------------------------------------------
> This sf.net email is sponsored by: Influence the future=3D3D20
> of Java(TM) technology. Join the Java Community=3D3D20
> Process(SM) (JCP(SM)) program now.=3D3D20
> http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=3D3D3Dsnort-users
>=3D3D20
>=3D3D20
> -------------------------------------------------------
> This sf.net email is sponsored by: Influence the future=3D3D20
> of Java(TM) technology. Join the Java Community=3D3D20
> Process(SM) (JCP(SM)) program now.=3D3D20
> http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=3D3D3Dsnort-users



--   __--__--  =3D20

Message: 3
Date: Thu, 24 Oct 2002 11:58:01 -0700
From: Gary Verhulp <garyv at ...7238...>
Reply-To: gary.verhulp at ...4477...
To: Joe Giles <jgiles at ...6534...>, snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Portscan 2 question

on most unix that I'm familiar with,it's "last" not "lasts"
what OS are you on?
what's the ports used in the scan?
can you post a section of the alert?

Gary



Joe Giles wrote:
> Well, I'm not RUNNING a DNS server, but I use one. My ISP's DNS...
> Should I add that to the list?=3D3D20
>=3D3D20
> Also, I don't seem to have the 'lasts' command. What package is that
> part of?
>=3D3D20
> Thanks for the reply
>=3D3D20
> Joe
>=3D3D20
> On Thu, 2002-10-24 at 12:03, Robby Desmond wrote:
>=3D3D20
>>At 11:22 AM 10/24/02 -0600, you wrote:
>>
>>>I have a weird problem with 2 entries in my ACID database. Apparently,
>>>my server did a port scan on a remote machine. The problem is that no
>>>one here initiated a port scan. The database lists my server IP as the
>>>source and lists a dest IP. This is listed as a spp_portscan2. Does the
>>>new snort scan other machines on the Internet? I don't want any issues
>>>with other services because they think I'm port scanning their network.
>>>
>>>Thanks
>>>
>>>Joe
>>
>>Are you, by chance, running DNS?
>>
>>You should add your DNS servers to the list of portscan2-ignorehosts,=3D3=
D2=3D
0
>>otherwise you will get this sort of activity.
>>
>>If you are not running DNS, then check the "lasts" command to see who =
=3D
=3D3D
has=3D3D20
>>been on your system. (Or who has been appearing as someone on your =3D3D
system.)
>>
>>-Robby
>>
>>Robert Desmond
>>Systems Administrator
>>UCSB Extended Learning Services
>>805-893-4906
>=3D3D20
>=3D3D20
>=3D3D20
>=3D3D20
>=3D3D20
> -------------------------------------------------------
> This sf.net email is sponsored by: Influence the future=3D3D20
> of Java(TM) technology. Join the Java Community=3D3D20
> Process(SM) (JCP(SM)) program now.=3D3D20
> http://ads.sourceforge.net/cgi-bin/redirect.pl?sunm0003en
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=3D3D3Dsnort-users
>=3D3D20
>=3D3D20





--   __--__--  =3D20

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-users


End of Snort-users Digest




--  __--__-- =20

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-users


End of Snort-users Digest




-- __--__-- 

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-users


End of Snort-users Digest




--__--__--

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-users


End of Snort-users Digest





More information about the Snort-users mailing list