[Snort-users] Newbie: What does this mean?

John Plate plate at ...13254...
Tue Apr 12 03:51:44 EDT 2005


Hi

I've found this in the log:

=========================================================================
 # of  from             to               method
=========================================================================
 30  192.168.1.2      65.54.186.250    (http_inspect) DOUBLE DECODING ATTACK

The IP 192.168.1.2 is my router to the Net. 

Does this mean that MY server did the attack?

Thanks in advance
John







More information about the Snort-users mailing list