[Snort-users] Apparent attacks from my firewall...?

doug doug at ...13122...
Thu Mar 3 05:08:06 EST 2005


i'm getting pounded by Intrusion Alerts that appear to be coming from my
Astaro Secure Linux firewall.

Here is a sample of the errors:
[1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of
Service] [Priority: 2]: <(null)> {PROTO006} 10.1.1.2:8081 ->
10.1.1.5:3372
[1:1408:0] D DOS MSDTC attempt [Classification: Attempted Denial of
Service] [Priority: 2]: <(null)> {PROTO006} 10.1.1.2:8081 ->
10.1.1.5:3372

This 1.2 address is my Astaro Firewall [v5.103]
The 1.5 address is my XP workstation.

Protocol 006 is TCP.  I'm wondering what might be causing this.

Much thanks & cheers to ya,

~Doug 




More information about the Snort-users mailing list