The other day I got a 'FTP EXPLOIT STAT *' event in my IDS from one of our
machines to a customer's FTP machine. We FTP to that machine on port 21 all
day long, so I know that it is just a false positive. I looked at the
decoded payload, and the traffic is HTTP traffic from our recruiting website
which is totally different from the machine snort reported this as. It has
an HTTP GET request, passes the User-Agent and HTTP Referrer data as well,
so I know this is true HTTP traffic.
So the destination machine is a known FTP server we use daily on port 21,
but the data in the packet according to snort is HTTP traffic from our
recruiting website. What is going on here?
If anyone wants me to send more data about this for debugging, just email me
direct.
Regards,
--
Michael Brancato
Senior Network Engineer
Affiliated Computer Services, Inc.
Lexington Division, Business Process Solutions
2432 Fortune Drive, Suite 120
Lexington, KY 40509
p: 859.389.4012
c: 859.420.7773
"The first version of Linux was like a time machine. It went back to a
system worse than what [Linus] already had on his desk."
- Andy Tanenbaum, author of
MINIX.
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
