[Snort-users] SA login failed.....

Jeff Heckart jheckart at ...12186...
Tue Mar 29 06:46:12 EST 2005


I am getting quite a few unusual alerts, and am confused with what I am
seeing.
 
The payload of the packet is:
04 01 00 3B 00 00 01 00 AA 27 00 18 48 00 00 01        ...;....*'..H...
0E 1B 00 4C 6F 67 69 6E 20 66 61 69 6C 65 64 20        ...Login failed 
66 6F 72 20 75 73 65 72 20 27 73 61 27 2E 00 00        for user 'sa'...
00 00 FD 02 00 00 00 00 00 00 00                       ..}........
 
The strange thing is that the source is:
x.x.x.x:1433 (our network)
Destination
x.x.x.x: 2838/random (remote unknown network)
 
This has now happened to two systems, both running mysql on tcp/1433.
It just makes no sense that the source port is 1433.  What am I missing
here?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050329/f96375a9/attachment.html>


More information about the Snort-users mailing list