I am getting a rather high (top 5) number of alerts showing up in ACID
displaying as simply "Tagged Packet" and having an sid=1, e.g.:
[snort] Tagged Packet unclassified 7118 (24%) 1 2 2 2004-12-31 18:02:59 2004-12-31 19:27:17
The URL given for reference is simply:
http://www.snort.org/snort-db/sid.html?sid=1
Here is a sample whole formatted alert:
Generated by ACID v0.9.6b23 on Fri, 31 Dec 2004 20:34:30 -0500
------------------------------------------------------------------------------
#(1 - 805067) [2004-12-31 18:47:28] [snort/1] Tagged Packet
IPv4: 64.12.165.56 -> 172.17.128.101
hlen=5 TOS=0 dlen=152 ID=47551 flags=0 offset=0 TTL=51 chksum=31717
TCP: port=7012 -> dport: 4618 flags=***AP*** seq=1474874013
ack=1336104986 off=5 res=0 win=5840 urp=0 chksum=2798
Payload: length = 112
000 : 3A 4C 6F 75 69 73 61 21 4C 6F 75 69 73 61 40 43 :Louisa!Louisa@C
010 : 42 35 45 36 43 30 30 2E 38 33 42 30 31 38 37 31 B5E6C00.83B01871
020 : 2E 42 36 44 45 36 36 34 39 2E 49 50 20 50 52 49 .B6DE6649.IP PRI
030 : 56 4D 53 47 20 23 65 6E 67 6C 69 73 68 20 3A 6E VMSG #english :n
040 : 6F 62 6F 64 79 20 77 69 6C 6C 20 67 6F 20 6F 75 obody will go ou
050 : 74 20 74 6F 20 63 65 6C 65 62 72 61 74 65 20 74 t to celebrate t
060 : 68 65 20 6E 65 77 20 79 65 61 72 3F 3F 0D 0A 00 he new year??...
Where is this coming from? I can't find a rule, only a mapping:
[root@aardvark snort]# grep Tagged ./*
./gen-msg.map:2 || 1 || tag: Tagged Packet
This is snort 2.2.0 Build 30 with freshly oinkmaster'ed rulesets from:
www.snort.org/dl/rules/snortrules-stable.tar.gz and
www.bleedingsnort.com/bleeding.rules.tar.gz
These seemed to start about the time I added the bleedingsnort rules,
but this may just be a coincidence.
Jeff
-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
