[Snort-users] ATTACK-RESPONSES id check returned root

Matt Kettler mkettler at ...4108...
Fri Oct 21 10:42:35 EDT 2005


Chris Romano wrote:
> I came in this moring and checked my snort alerts (morning routine), and
> noticed the following:
> 
> ATTACK-RESPONSES id check returned root            2005-10-21
> 07:40:32            82.165.25.125:80
> <http://82.165.25.125:80>             10.10.10.5:51949
> <http://10.10.10.5:51949>             TCP
> 

Upon closer inspection, I'm *positive* that was matching someone reading a
website. All that exact text is posted in a Phrack issue to be exact.

One (of many) places with it:
http://www.nata2.info/?path=misc/phrack/phrack58&text=p58-0x07.txt




More information about the Snort-users mailing list