[Snort-users] ATTACK-RESPONSES id check returned userid

Roelf Schreurs rosc at ...9480...
Tue Jun 17 02:30:22 EDT 2003


Hi

When we connect to one specific website, www.marca.com, I get a lot of
alerts.
The source adress is my NAT'ed address and the destination is the IP of
this website.

Can somebody please explain why I get this as an alert.

Thanks

ID 		= #0-(1-355)
SIGNATURE 	= ATTACK-RESPONSES id check returned userid    	
TIMESTAMP	= 2003-06-17 09:30:34
SOURCE IP	= $MY_NAT_IP:57967     	
DEST IP		= 212.80.128.10:80
LAYER 4 PROTO	= TCP


-- 
Roelf





More information about the Snort-users mailing list