I too have (and still use) aanval, I do not notice this type of
activity/anomaly. Yes this option is turned off.
Plain and simple your config is whacked. If your 'using' safe mode against
the wishes of the tool, you may be the culprit.
Cheers,
James Friesen, CIO
Lucretia Enterprises
"Our World Is Here..."
Info at lucretia dot ca
http://lucretia.ca
-----Original Message-----
From: Michael Scheidell [mailto:scheidell@secnap.net]
Sent: Friday, January 27, 2006 4:34 AM
To: Nerijus Krukauskas; Snort Users
Subject: RE: [Snort-users] Anyone have problems with aanval?
-----Original Message-----
From: Nerijus Krukauskas [mailto:nkrukauskas@gmail.com]
Sent: Friday, January 27, 2006 3:01 AM
To: Snort Users
Cc: Michael Scheidell
Subject: Re: [Snort-users] Anyone have problems with aanval?
On 27/01/06, Michael Scheidell <scheidell@secnap.net> wrote:
We traced a very large data transfer from the host we had running
aanval to 82.165.229.52
Interesting thing about that ip address:
host www.aanval.com
www.aanval.com is a nickname for aanval.com aanval.com
has address
82.165.229.52 aanval.com mail is handled (pri=10) by
mail.aanval.com
82.165.229.51 is also known as oad.aanval.com. OAD stands for
'Offender Analysis Database'. And default install of aanval console
sends lot's of data to that database. In aanval console go
Aanval ->
System Options -> Processor Options -> uncheck the
'Offender Analysis
Database' option -> press 'Update Options' -> see how the
traffic to
oad.aanval.com stops.
21GB? 7 hours? Do the math, that will saturate two t1's for 7 hours.
And you noticed this AFTER SEVEN HOURS? Wow.
Pretty slack network monitoring.
And besides, we turned it off in system options the day we
installed it.
Did RTFM.
Thanks for playing, next player?
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
