I listed a lot of files within a folder that snort has automatically
generated for my own IP... The IP of my machine?!?! What the hell is going
on??? Is my machine attacking itself on a total madness rampage? Or does
this mean my machine is attacking other computers out of a sudden??? Here's
the directory list...
-rw------- 1 root root 4697 Dec 29 19:43 PROTO255
-rw------- 1 root root 352 Dec 29 12:25 TCP:1111-80
-rw------- 1 root root 353 Dec 29 17:11 TCP:1324-80
-rw------- 1 root root 354 Dec 29 17:33 TCP:1415-80
-rw------- 1 root root 345 Dec 29 17:34 TCP:1416-80
-rw------- 1 root root 359 Dec 29 18:21 TCP:1922-80
-rw------- 1 root root 361 Dec 29 18:21 TCP:1926-80
-rw------- 1 root root 361 Dec 29 18:21 TCP:1930-80
-rw------- 1 root root 353 Dec 29 19:48 TCP:2098-80
-rw------- 1 root root 303 Dec 29 21:34 TCP:2281-80
-rw------- 1 root root 303 Dec 29 21:34 TCP:2286-80
-rw------- 1 root root 303 Dec 29 21:34 TCP:2287-80
-rw------- 1 root root 303 Dec 29 21:34 TCP:2288-80
-rw------- 1 root root 353 Dec 29 21:34 TCP:2302-80
-rw------- 1 root root 345 Dec 29 21:34 TCP:2303-80
And here is ome lines that appeared on the PROTO255 file:
[**] (portscan) TCP Portsweep [**]
12/29-17:35:11.542611 xxx.xxx.xxx.xxx -> 65.54.183.192
PROTO255 TTL:0 TOS:0x0 ID:2011 IpLen:20 DgmLen:159 DF
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
[**] (portscan) Open Port [**]
12/29-17:35:11.546545 xxx.xxx.xxx.xxx -> 80.67.81.134
PROTO255 TTL:0 TOS:0x0 ID:0 IpLen:20 DgmLen:34 DF
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
[**] (portscan) Open Port [**]
12/29-17:35:13.762729 xxx.xxx.xxx.xxx -> 207.46.216.60
PROTO255 TTL:0 TOS:0x0 ID:29885 IpLen:20 DgmLen:34
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
[**] (portscan) Open Port [**]
12/29-17:35:13.799008 xxx.xxx.xxx.xxx -> 209.67.78.3
PROTO255 TTL:0 TOS:0x0 ID:51137 IpLen:20 DgmLen:34 DF
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
Looks like my machine has gone totally mad and is portscanning machines
randomly... I don't have a clue of whati is going on... :-(
Somebody please help.
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
