[Snort-users] Aberrant alerts with snort 2.1.0 build 9

John Sage jsage at ...2022...
Thu Feb 5 11:22:02 EST 2004


I'm receiving sporadic alert aberrations, thus:

Feb  5 09:25:37 greatwall snort: [1:483:2] ICMP PING CyberKit 2.2
Windows [Classification: Misc activity] [Priority: 3]: {UDP}
23.19.147.225:666 -> 24.19.147.xxx:1026
Feb  5 09:25:37 greatwall kernel: Block: udp: IN=eth0 OUT=
MAC=00:40:05:88:27:24:00:0a:42:6e:f8:54:08:00 SRC=23.19.147.225
DST=24.19.147.xxx LEN=574 TOS=0x00 PREC=0x00 TTL=113 ID=27832
PROTO=UDP SPT=666+DPT=1026 LEN=554

Feb  5 09:25:37 greatwall snort: [1:483:2] ICMP PING CyberKit 2.2
Windows [Classification: Misc activity] [Priority: 3]: {UDP}
23.19.147.225:666 -> 24.19.147.xxx:1027
Feb  5 09:25:37 greatwall kernel: Block: udp: IN=eth0 OUT=
MAC=00:40:05:88:27:24:00:0a:42:6e:f8:54:08:00 SRC=23.19.147.225
DST=24.19.147.xxx LEN=574 TOS=0x00 PREC=0x00 TTL=113 ID=27834
PROTO=UDP SPT=666+DPT=1027 LEN=554


I have seen this from what are really UDP or TCP packets, but are
being reported as CyberKit pings. CyberKit pings themselves are being
reported correctly.

Is this the sort of "Alert mangling fixes" that 2.1.1-RC1 is hoping to
fix?



- John
-- 
Mad cow? You'd be mad too, if someone was trying to eat you.




More information about the Snort-users mailing list