Re: [Snort-sigs] odd rule behaviour ???

On Tue, 2005-11-29 at 11:04 +1300, Russell Fulton wrote:
> Recently I started getting lots of hits on this rule (60,000 a day) and
> I decided to add something to the threshold file to keep the noise down.
> Then I noticed that the traffic that is triggering the rule has a
> *source* port of zero, not a destination port of zero.  Now I'm sorely
> puzzled - some one please tell me there is a straight forward
> explanation and that I'm an idiot :)

Looks like someone's spam spewing engine (manually crafted packets
inserted on the wire, incl spoofed sources addresses) went bad. This
could be bad/clueless coding of the packet insertion routine, or perhaps
host-based software (firewall/IPS) or network based stiff (firewall)
mangling the packet while leaving the bot infected spam spewer.

I'm surprised you are still looking at UDP/1025 packets... ;)

Cheers,
Frank

-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

signature.asc
Description: This is a digitally signed message part