Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Users
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Snort-users] How should alerts be interpreted? hacker's_machine -> vict

from [Palula Brasil] Network Security [Permanent Link]
Subject: [Snort-users] How should alerts be interpreted? hacker's_machine -> victim's_machine?
Date: Thu, 13 Apr 2006 15:12:23 -0300 
Ok! Alerts are workin fine. But indeed there is another problem.
Here is the problem: the alert file has these. 

[**] [122:7:0] (portscan) TCP Filtered Portsweep [**]
04/12-22:30:29.305031 x.x.x.x:port -> 38.119.49.39
PROTO255 TTL:0 TOS:0x0 ID:5901 IpLen:20 DgmLen:162 DF

and...

[**] [119:15:1] (http_inspect) OVERSIZE REQUEST-URI DIRECTORY [**]
04/12-23:14:22.648030 x.x.x.x:port -> 66.165.172.181:80
TCP TTL:64 TOS:0x0 ID:30828 IpLen:20 DgmLen:1452 DF
***A**** Seq: 0x3B8C6DA9  Ack: 0x7AAF4300  Win: 0x5AC  TcpLen: 32
TCP Options (3) => NOP NOP TS: 54649465 770359521

But the thing is that x.x.x.x:port is my machines IP and port. Looks like it's 
gone mad and is doing totally random port scans and http inspects on whatever 
machines.

According to snort docs, the correct interpretation for these alerts is:
hacker's machine -> victim's machines

Has my machine gone mad and is making victims out of a sudden? Home network ( 
-h x.x.x.x/x) has been defined, by the way.

Thanks! :-)
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Snort-users] pmgraph.pl on win32?, phish phreek
Next by Date:  [Snort-users] tcp_decode logging, vulnerable
Previous by Thread:  [Snort-users] Inline and stream 4, Pieter Vanmeerbeek
Next by Thread:  RE: [Snort-users] How should alerts be interpreted? hacker's_machine -> victim's_machine?, Patrick S. Harper
Indexes:  [Date] [Thread] [Top] [All Lists]