OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: [Snort-users] bug?
From: Joe McAlerney (joeysilicondefense.com)
Date: Tue Nov 21 2000 - 18:22:06 CST

eziman ussr wrote:
>
> im using the snort 1.6.3 whit 10102k.rules and i have the log
>
> Nov 2 2 07:30:26 IDS127 - TELNET - Login Incorrect
> gutenberg.ussrback.net 23 timezero.ar-ussrlabs.com 2535
> Nov 2 2 07:31:08 IDS364 - FTP-bad-login gutenberg.ussrback.net
> 21 timezero.ar-ussrlabs.com 2536
>
> and is en reverse order! (target are source and source are target).
>
> Are this a bug or missconfigured?
>
> Thanks..
>
> eziman.-

It looks like someone from timezero.ar-ussrlabs.com tried to telnet and
FTP to gutenberg.ussrback.net, but failed to log in. The server
(gutenberg) sent the appropriate message back, and that's what Snort
caught.

-Joe M. 

-- 
+--                            --+
| Joe McAlerney, Silicon Defense |
| http://www.silicondefense.com/ |
+--                            --+
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
http://lists.sourceforge.net/mailman/listinfo/snort-users