I have a couple of thousand of these triggered by Bittorrent traffic:
META
--------
SID CID TimeStamp Signature
6 7983912 2006-02-09 23:46:42 EXPLOIT Veritas Backup Agent DoS attempt
Sig ID
3696
Sensor Hostname Sensor Interface
hihi.insec.auckland.ac.nz new dmz sensor
IP
--------
Source Address Dest Address Ver Hdr Len
130.216.226.204 80.195.60.140 4 5
TOS length ID flags offset TTL chksum
0 1500 58619 2 0 124 8492
Resolved Source
j.leef.afac.auckland.ac.nz
Resolved Dest
80-195-60-140.cable.ubr04.uddi.blueyonder.co.uk
TCP
--------
Source Port Dest Port Seq Ack
2953 10000 1339957372 2155276165
Offset Reserved Flags Window Checksum Urgent Ptr
5 0 16 64183 44698 0
Options
--------
None
Flags
--------
RB 1 RB 0 URG ACK PSH RST SYN FIN
X
DATA
--------
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F475C ........G\
0FD7BFEE6047F4C7F233 ....`G...3
C11A9DBC3FD73FEB9FAC ....?.?...
ED7F277E1BF987F8DB90 ..'~......
0686EFEEB78ABCB7C6AB ..........
F8A8E790066000000000 .....`....
00000000000000F9AF77 .........w
E276BF0D9BC24627BFE8 .v....F'..
0FACEFFF30FE1B9F475D ....0...G]
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F475E ........G^
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F475F ........G_
0F9006FAE3B2106A9A04 .......j..
06770414399006BB1FC9 .w..9.....
1ED77B6BD8DCDDB7F990 ..{k......
0630FF2CA13963B52892 .0.,.9c.(.
6C87F1900691BEB304A0 l.........
29A745895C481C001693 ).E.\H....
A949D134B437F60026EF .I.4.7..&.
CE9B9EFAD9992D9F4760 ......-.G`
0F9006895164B5EFE641 ....Qd...A
FC8140A1809006000000 ..@.......
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F4761 ........Ga
0FEFFFE34FEC2DDFE72F ....O.-../
E3EFE80CBFEC7FE2EFE8 ..........
DEA7F337F1C5D3FE3490 ...7....4.
06C5FD7FE50F7BD8DCEE ......{...
EDF6F39006FF1D4474E7 .......Dt.
BF7E59DB1B63F3FAAEFD .~Y..c....
9294BA860810C7213FE6 .......!?.
AEFF5FAFD9FE519F4762 .._...Q.Gb
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F4763 ........Gc
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F4764 ........Gd
0F9006FD360000000000 ....6.....
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F4765 ........Ge
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F4766 ........Gf
0FA7FFE5F54FE73FE725 .....O.?.%
08BFCA5FCAA5FFE57C99 ..._....|.
FF99FF99AFBB6F6BF990 ......ok..
067ECFB0A114820290F7 .~........
90091490061231D2C57F ......1...
25F7FBD765C996001653 %...e....S
8C2DB2DB23045900264E .-..#.Y.&N
130A6B454500829F4767 ..kEE...Gg
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F4768 ........Gh
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000007F4707 ........G.
FFFFFFFFFFFFFFFFFFFF ..........
FFFFFFFFFFFFFFFFFFFF ..........
FFFFFFFFFFFFFFFFFFFF ..........
FFFFFFFFFFFFFFFFFFFF ..........
FFFFFFFFFFFFFFFFFFFF ..........
FFFFFFFFFFFFFFFFFFFF ..........
FFFFFFFFFFFFFFFFFFFF ..........
FFFFFFFFFFFFFF9F4769 ........Gi
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F476A ........Gj
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F476B ........Gk
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
00FFFF90060000000000 ..........
00000000000000001600 ..........
00000000000000002600 ........&.
000000000000009F476C ........Gl
0F900600000000000000 ..........
000000FFFF9006000000 ..........
00000000000000000090 ..........
06000000000000000000 ..........
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
