[Snort-users] SCAN Proxy (8080) attempt

Marcel error79 at ...348...
Sun Jul 6 10:11:07 EDT 2003


Hallo

I am having following problem.
Snort is running on the externel interface and there is also running a
Squid Daemon on the internal interface listening on port 8080.
The Internal Network is beeing set up as "homenetwork".
Now everytime one of the internal Clients is surfing the net, snort
gives me following "Scan Proxy attempt" message.

Jun 16 10:49:47 *** snort: [1:620:2] SCAN Proxy (8080) attempt
[Classification: Attempted Information Leak] [Priority: 2]: {TCP}
192.168.181.86:50358 -> 192.168.181.222:8080

Can someone tell me how to get rid of these annoying messages?

Thanks in advance

Marcel





More information about the Snort-users mailing list