Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Subject: Re: [Snort-users] bug?
From: Joe McAlerney (joeysilicondefense.com)
Date: Tue Nov 21 2000 - 18:22:06 CST
- Next message: box.inter-tel.net: "Re: [Snort-users] Who's using Snort?"
- Previous message: Fyodor: "Re: [Snort-users] bug?"
- In reply to: eziman ussr: "[Snort-users] bug?"
- Reply: Joe McAlerney: "Re: [Snort-users] bug?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
eziman ussr wrote:
> im using the snort 1.6.3 whit 10102k.rules and i have the log
> Nov 2 2 07:30:26 IDS127 - TELNET - Login Incorrect
> gutenberg.ussrback.net 23 timezero.ar-ussrlabs.com 2535
> Nov 2 2 07:31:08 IDS364 - FTP-bad-login gutenberg.ussrback.net
> 21 timezero.ar-ussrlabs.com 2536
> and is en reverse order! (target are source and source are target).
> Are this a bug or missconfigured?
It looks like someone from timezero.ar-ussrlabs.com tried to telnet and
FTP to gutenberg.ussrback.net, but failed to log in. The server
(gutenberg) sent the appropriate message back, and that's what Snort
-- +-- --+ | Joe McAlerney, Silicon Defense | | http://www.silicondefense.com/ | +-- --+ _______________________________________________ Snort-users mailing list Snort-userslists.sourceforge.net http://lists.sourceforge.net/mailman/listinfo/snort-users