Oct 15 18:15:40 snort[29444]: | gen-id=1 sig-id=7558 type=Limit tracking=src count=1 seconds=600 Oct 15 18:15:40 snort[29444]: | gen-id=1 sig-id=7558 type=Limit tracking=src count=1 seconds=600 Oct 15 18:15:40 snort[29444]: | gen-id=1 sig-id=6176 type=Limit tracking=src count=1 seconds=300 Oct 15 18:15:40 snort[29444]: | gen-id=1 sig-id=6176 type=Limit tracking=src count=1 seconds=300 Oct 15 18:15:40 snort[29444]: | gen-id=1 sig-id=6398 type=Limit tracking=src count=1 seconds=300 Oct 15 18:15:40 snort[29444]: | gen-id=1 sig-id=6398 type=Limit tracking=src count=1 seconds=300 Oct 15 18:15:40 snort[29444]: | gen-id=1 sig-id=7589 type=Limit tracking=src count=1 seconds=300 Oct 15 18:15:40 snort[29444]: | gen-id=1 sig-id=7589 type=Limit tracking=src count=1 seconds=300 Oct 15 18:15:40 snort[29444]: +-----------------------[suppression]------------------------------------------ Oct 15 18:15:40 snort[29444]: +-----------------------[suppression]------------------------------------------ Oct 15 18:15:40 snort[29444]: | none Oct 15 18:15:40 snort[29444]: | none Oct 15 18:15:40 snort[29444]: ------------------------------------------------------------------------------- Oct 15 18:15:40 snort[29444]: ------------------------------------------------------------------------------- Oct 15 18:15:40 snort[29444]: Rule application order: ->activation->dynamic->pass->drop->alert->log Oct 15 18:15:40 snort[29444]: Rule application order: ->activation->dynamic->pass->drop->alert->log Oct 15 18:15:40 snort[29444]: Log directory = /var/log/snort Oct 15 18:15:40 snort[29444]: Log directory = /var/log/snort Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'backdoor.charon.download.log.1' is checked but not ever set. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'backdoor.charon.download.log.1' is checked but not ever set. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'dce.isystemactivator.bind.call.attempt' is set but not ever checked. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'dce.isystemactivator.bind.call.attempt' is set but not ever checked. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'optixlite_fai_conn_cts' is set but not ever checked. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'optixlite_fai_conn_cts' is set but not ever checked. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'fkwp_conn_suc_cts' is set but not ever checked. Oct 15 18:15:40 snort[29444]: Warning: flowbits key 'fkwp_conn_suc_cts' is set but not ever checked. Oct 15 18:15:40 kernel: sis0: promiscuous mode enabled Oct 15 18:15:40 snort[29444]: Var 'sis0_ADDRESS' defined, value len = 25 chars Oct 15 18:15:40 snort[29444]: Var 'sis0_ADDRESS' defined, value len = 25 chars Oct 15 18:15:40 snort[29444]: , value = 192.168.0.0/255.255.255.0 Oct 15 18:15:40 snort[29444]: , value = 192.168.0.0/255.255.255.0 Oct 15 18:15:40 kernel: sis0: promiscuous mode disabled Oct 15 18:15:40 snort[29444]: Initializing daemon mode Oct 15 18:15:40 snort[29444]: Initializing daemon mode Oct 15 18:15:40 kernel: sis0: promiscuous mode enabled Oct 15 18:15:40 snort[29445]: Var 'sis0_ADDRESS' redefined Oct 15 18:15:40 snort[29445]: Var 'sis0_ADDRESS' redefined Oct 15 18:15:40 snort[29445]: PID path stat checked out ok, PID path set to /var/run/ Oct 15 18:15:40 snort[29445]: PID path stat checked out ok, PID path set to /var/run/ Oct 15 18:15:40 snort[29445]: Writing PID "29445" to file "/var/run//snort_sis0.pid" Oct 15 18:15:40 snort[29445]: Writing PID "29445" to file "/var/run//snort_sis0.pid" Oct 15 18:15:40 snort[29444]: Daemon parent exiting Oct 15 18:15:40 snort[29444]: Daemon parent exiting Oct 15 18:15:40 snort[29445]: Daemon initialized, signaled parent pid: 29444 Oct 15 18:15:40 snort[29445]: Daemon initialized, signaled parent pid: 29444 Oct 15 18:15:52 kernel: sis0: promiscuous mode disabled