I already sent a pcap to development. Do you need another one?
--On Thursday, November 09, 2006 12:49:56 -0500 Brian <bmc@snort.org> wrote:
On Tue, Nov 07, 2006 at 02:22:14PM -0600, Paul Schmehl wrote:
I'm getting a boatload of alerts from one host for this SID. The rule
looks for [01 03] (SOH followed by ETX) at a depth of 2 bytes. Every
single packet that triggers this alert begins with this sequence: 17 03
01 03 80
ETB ETX SOH ETX followed by a high ascii character. So, End of
Transmission Block, End of Text, Start of Heading, End of Text, high
ascii.
Any of you uber-geeks want to translate what this host is doing? Or
attempting to do? (BTW, I suspect this is "benign" activity. The
source host is on a local ISP's network, and the dest host is our imap
server. The alerts are triggered every two minutes, give or take a
hundredth of a second, so it looks like aggressive mail checking.)
Is this a broken client? Eeeevvviiilll?
IIRC, I wrote those rules. Send me pcap. I'll take a look.
Brian
Paul Schmehl (pauls@utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
p7sYV8DrYnZ7g.p7s
Description: S/MIME cryptographic signature
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
