OpenVPN uses UDP 1194
From http://openvpn.net/howto.html:
The sample server configuration file is an ideal starting point for an
OpenVPN server configuration. It will create a VPN using a virtual TUN
network interface (for routing), will listen for client connections on UDP
port 1194 (OpenVPN's official port number), and distribute virtual addresses
to connecting clients from the 10.8.0.0/24 subnet.
Shirkdog
http://www.shirkdog.us
From: "Willy, Andrew" <AWilly@eSMIL.net>
To: snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] (snort_decoder): Short UDP packet, length field
> payload leng
Date: Thu, 14 Jul 2005 09:57:02 -0700
The vendor supports medical equipment. Seems as though the packets were
destined for their publicly addressed network, and I've seen before that
somehow UDP factors into their software VPN client intialization, so
perhaps
the traffic was legitimate but somehow corrupted?
Thanks
Andrew
-----Original Message-----
From: M. Shirk [mailto:shirkdog_list@hotmail.com]
Sent: Thursday, July 14, 2005 8:54 AM
To: snort-users@lists.sourceforge.net
Subject: RE: [Snort-users] (snort_decoder): Short UDP packet, length
field > payload leng
Does the vendor know the network impact of their product? (or any specs on
the protocols the product uses for you to research?)
Shirkdog
http://www.shirkdog.us
>From: "Willy, Andrew" <AWilly@eSMIL.net>
>To: snort-users@lists.sourceforge.net
>Subject: RE: [Snort-users] (snort_decoder): Short UDP packet, length
field
> > payload length
>Date: Thu, 14 Jul 2005 08:42:38 -0700
>
>Interesting, I just saw this alert for the first time yesterday. When
you
>say it is a bad thing, you mean as in potential exploit? The were four
>alerts that originated from a vendor machine that plugged into our DMZ.
As
>far as I can tell, there is no payload. I'm not sure what to make of it.
>
>Thank you,
>
>Andrew
NOTICE OF CONFIDENTIALITY-The information in this email, including
attachments, may be confidential and/or privileged and may contain
confidential health information. This email is intended to be reviewed only
by the individual or organization named as addressee. If you have received
this email in error please notify Scottsdale Medical Imaging, an affiliate
of Southwest Diagnostic Imaging, LTD immediately - by return message to the
sender or to support@esmil.com - and destroy all copies of this message and
any attachments. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent those
of Scottsdale Medical Imaging. Confidential health information is protected
by state and federal law, including, but not limited to, the Health
Insurance Portability and Accountability Act of 1996 and related
regulations.
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
_________________________________________________________________
Is your PC infected? Get a FREE online computer virus scan from McAfee®
Security. http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963
-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_id=7477&alloc_id=16492&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
