[Snort-users] ATTACK-RESPONSES id check returned root
mkettler at ...4108...
Fri Oct 21 10:42:35 EDT 2005
Chris Romano wrote:
> I came in this moring and checked my snort alerts (morning routine), and
> noticed the following:
> ATTACK-RESPONSES id check returned root 2005-10-21
> 07:40:32 18.104.22.168:80
> <http://22.214.171.124:80> 10.10.10.5:51949
> <http://10.10.10.5:51949> TCP
Upon closer inspection, I'm *positive* that was matching someone reading a
website. All that exact text is posted in a Phrack issue to be exact.
One (of many) places with it:
More information about the Snort-users