Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Snort-users] Suggested directions for inverstigation??

from [Mike Kelley] Network Security [Permanent Link]
Subject: [Snort-users] Suggested directions for inverstigation??
Date: Tue, 23 Nov 2004 23:20:13 -0700 
I just brought up my snort\acid\mysql box.

 

I have a situation where I am seeing hundreds of alerts with the same
source IP and the same destination IP; it seems to be getting hit by 3
alert signatures, these alerts are climbing the ports on the source but
all point back to the destination on port 80.

 

The alerts are 

 

(http_inspect) APACHE WHITESPACE (TAB)   

(http_inspect) BARE BYTE UNICODE ENCODING   

(http_inspect) NON-RFC HTTP DELIMITER

 

Since I'm seeing the ports increment numerically (most of the time,
sometimes there are gaps of 2-10 ports) I'm under the impression I'm
getting port scanned on the source box (internal IP on corp network) by
the destination (public IP).

 

Would anyone (please) point me in the next direction on investigating
what is going on and what to do. My team and I can "big hammer" the
situation by formatting the destination and securing the firewall
implicitly on the source IP, but what I'm hoping to find out is what
would those of you with years of working these incidents do?

 

Here is the ARIN whois on the source IP

**SNIP** 

Server Used: [ whois.arin.net ]

66.182.90.242
<http://www.samspade.org/t/whois?a=66.182.90.242;server=auto>  = [
cust-66-182-90-242.bbsc.net
<http://www.samspade.org/t/whois?a=cust-66-182-90-242.bbsc.net;server=au
to>  ] 

 
  OrgName:    BroadBand Solutions America 
  OrgID:      BSA-26 
  Address:    630 West 9560 South Suite A 
  City:       Sandy 
  StateProv:  UT 
  PostalCode: 84070 
  Country:    US 
  NetRange:   66.182.64.0
<http://www.samspade.org/t/whois?a=66.182.64.0;server=auto>  -
66.182.95.255
<http://www.samspade.org/t/whois?a=66.182.95.255;server=auto>  
  CIDR:       66.182.64.0/19 
  NetName:    BBSC-NET 
  NetHandle:   NET-66-182-64-0-1
<http://www.samspade.org/t/whois?a=NET-66-182-64-0-1;server=whois.arin.n
et>  
  Parent:     NET-66-0-0-0-0 
  NetType:    Direct Allocation 
  NameServer: NS1.BBSC.NET
<http://www.samspade.org/t/whois?a=NS1.BBSC.NET;server=auto>  
  NameServer: NS4.BBSC.NET
<http://www.samspade.org/t/whois?a=NS4.BBSC.NET;server=auto>  

 

**SNIP**

 

Thanks in advance to any and all suggestions (tell me which ones to read
and I'll RTFM!!!)

Mike
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
  • [Snort-users] Suggested directions for inverstigation??, Mike Kelley <=
Previous by Date:  [Snort-users] why is gid missing from the db schema ?, Yarden Livnat
Next by Date:  RE: [Snort-users] exporting snort logs, Endre Szekely-Bencedi
Previous by Thread:  [Snort-users] why is gid missing from the db schema ?, Yarden Livnat
Next by Thread:  [Snort-users] how ACID delete older rows ?, Mahboobeh Soleimani
Indexes:  [Date] [Thread] [Top] [All Lists]