Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Security-Basics
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: how do i read this IDS log?

from [Javier Sanchez] Network Security [Permanent Link]
Subject: Re: how do i read this IDS log?
Date: Mon, 29 Nov 2004 19:38:01 +0100 

As far as i know every new connection use a different source port. Thats
complete normal as far as i know, if snmp connections arent like http
keep-alive f. ex., one connection one source port.

Cheers


El dom, 28-11-2004 a las 12:46, Rino Mardo escribió:

folks, i have collected a small IDS log from my network. although i
can somehow interpret that it seems to be an snmp vulnerability scan,
i can't seem to figure out why the source ip is using different ports.
appreciate your help on this.

here is the complete scan:

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/22-10:19:32.187608 xx.xx.xx.xx:1630 -> 255.255.255.255:161
UDP TTL:128 TOS:0x0 ID:1998 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81  0.......public..
DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06  ..........0..0..
07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06  .+........0...+.
01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01  .......0...+....
01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01  ....0...+.......
06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01  ...0...+........
05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03  ..0...+.........
05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01  ..0...+.........
01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03  ....0...+.......
09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B  ......0...+.....
02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04  ........0...+...
01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06  ..........0...+.
01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B  ...........0...+
06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B  ............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00           +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/22-10:19:32.891551 xx.xx.xx.xx:1630 -> 255.255.255.255:161
UDP TTL:128 TOS:0x0 ID:2146 IpLen:20 DgmLen:267
Len: 239
30 81 EC 02 01 00 04 08 69 6E 74 65 72 6E 61 6C  0.......internal
A1 81 DC 02 01 00 02 01 00 02 01 00 30 81 D0 30  ............0..0
0B 06 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07  ...+........0...
2B 06 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01  +........0...+..
02 01 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02  ......0...+.....
02 01 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14  .....0...+......
01 01 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02  ....0...+.......
01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03  ....0...+.......
09 01 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B  ......0...+.....
02 03 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04  ........0...+...
01 0B 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06  ..........0...+.
01 04 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B  ............0...
2B 06 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06  +............0..
0B 2B 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F  .+............0.
06 0B 2B 06 01 04 01 0B 02 04 03 0D 01 05 00     ..+............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/22-10:19:33.357811 xx.xx.xx.xx:1630 -> 255.255.255.255:161
UDP TTL:128 TOS:0x0 ID:2184 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81  0.......public..
DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06  ..........0..0..
07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06  .+........0...+.
01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01  .......0...+....
01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01  ....0...+.......
06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01  ...0...+........
05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03  ..0...+.........
05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01  ..0...+.........
01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03  ....0...+.......
09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B  ......0...+.....
02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04  ........0...+...
01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06  ..........0...+.
01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B  ...........0...+
06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B  ............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00           +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/22-10:20:01.592360 xx.xx.xx.xx:1914 -> 255.255.255.255:161
UDP TTL:128 TOS:0x0 ID:2970 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81  0.......public..
DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06  ..........0..0..
07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06  .+........0...+.
01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01  .......0...+....
01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01  ....0...+.......
06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01  ...0...+........
05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03  ..0...+.........
05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01  ..0...+.........
01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03  ....0...+.......
09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B  ......0...+.....
02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04  ........0...+...
01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06  ..........0...+.
01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B  ...........0...+
06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B  ............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00           +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/22-10:20:03.127504 xx.xx.xx.xx:1914 -> 255.255.255.255:161
UDP TTL:128 TOS:0x0 ID:3093 IpLen:20 DgmLen:267
Len: 239
30 81 EC 02 01 00 04 08 69 6E 74 65 72 6E 61 6C  0.......internal
A1 81 DC 02 01 00 02 01 00 02 01 00 30 81 D0 30  ............0..0
0B 06 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07  ...+........0...
2B 06 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01  +........0...+..
02 01 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02  ......0...+.....
02 01 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14  .....0...+......
01 01 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02  ....0...+.......
01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03  ....0...+.......
09 01 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B  ......0...+.....
02 03 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04  ........0...+...
01 0B 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06  ..........0...+.
01 04 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B  ............0...
2B 06 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06  +............0..
0B 2B 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F  .+............0.
06 0B 2B 06 01 04 01 0B 02 04 03 0D 01 05 00     ..+............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/22-10:20:03.191711 xx.xx.xx.xx:1914 -> 255.255.255.255:161
UDP TTL:128 TOS:0x0 ID:3095 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81  0.......public..
DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06  ..........0..0..
07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06  .+........0...+.
01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01  .......0...+....
01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01  ....0...+.......
06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01  ...0...+........
05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03  ..0...+.........
05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01  ..0...+.........
01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03  ....0...+.......
09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B  ......0...+.....
02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04  ........0...+...
01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06  ..........0...+.
01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B  ...........0...+
06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B  ............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00           +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/22-10:21:38.373587 xx.xx.xx.xx:2587 -> 255.255.255.255:161
UDP TTL:128 TOS:0x0 ID:4790 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81  0.......public..
DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06  ..........0..0..
07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06  .+........0...+.
01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01  .......0...+....
01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01  ....0...+.......
06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01  ...0...+........
05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03  ..0...+.........
05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01  ..0...+.........
01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03  ....0...+.......
09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B  ......0...+.....
02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04  ........0...+...
01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06  ..........0...+.
01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B  ...........0...+
06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B  ............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00           +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/22-10:21:39.142089 xx.xx.xx.xx:2587 -> 255.255.255.255:161
UDP TTL:128 TOS:0x0 ID:4798 IpLen:20 DgmLen:267
Len: 239
30 81 EC 02 01 00 04 08 69 6E 74 65 72 6E 61 6C  0.......internal
A1 81 DC 02 01 00 02 01 00 02 01 00 30 81 D0 30  ............0..0
0B 06 07 2B 06 01 02 01 01 01 05 00 30 0B 06 07  ...+........0...
2B 06 01 02 01 01 03 05 00 30 0B 06 07 2B 06 01  +........0...+..
02 01 01 05 05 00 30 0D 06 09 2B 06 01 02 01 02  ......0...+.....
02 01 06 05 00 30 0D 06 09 2B 06 01 02 01 04 14  .....0...+......
01 01 05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02  ....0...+.......
01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03  ....0...+.......
09 01 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B  ......0...+.....
02 03 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04  ........0...+...
01 0B 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06  ..........0...+.
01 04 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B  ............0...
2B 06 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06  +............0..
0B 2B 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F  .+............0.
06 0B 2B 06 01 04 01 0B 02 04 03 0D 01 05 00     ..+............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

11/22-10:21:39.873510 xx.xx.xx.xx:2587 -> 255.255.255.255:161
UDP TTL:128 TOS:0x0 ID:4800 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81  0.......public..
DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 0B 06  ..........0..0..
07 2B 06 01 02 01 01 01 05 00 30 0B 06 07 2B 06  .+........0...+.
01 02 01 01 03 05 00 30 0B 06 07 2B 06 01 02 01  .......0...+....
01 05 05 00 30 0D 06 09 2B 06 01 02 01 02 02 01  ....0...+.......
06 05 00 30 0D 06 09 2B 06 01 02 01 04 14 01 01  ...0...+........
05 00 30 0E 06 0A 2B 06 01 02 01 19 03 02 01 03  ..0...+.........
05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03 09 01  ..0...+.........
01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03  ....0...+.......
09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B  ......0...+.....
02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04  ........0...+...
01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06  ..........0...+.
01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B  ...........0...+
06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B  ............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00           +............
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  how do i read this IDS log?, Rino Mardo
Next by Date:  RE: DOS Attack?, David Gillett
Previous by Thread:  how do i read this IDS log?, Rino Mardo
Next by Thread:  RE: how do i read this IDS log?, Beauford, Jason
Indexes:  [Date] [Thread] [Top] [All Lists]