Feb 14 15:29:44 moatmonster sshd[9787]: Accepted keyboard-interactive/pam for root from 192.168.0.43 port 2641 ssh2 Feb 14 15:29:44 moatmonster sshd(pam_unix)[9792]: session opened for user root by root(uid=0) Feb 14 15:30:01 moatmonster cron[9797]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons ) Feb 14 15:30:02 moatmonster barnyard[9642]: Exiting Feb 14 15:38:46 moatmonster sshd[9881]: Accepted keyboard-interactive/pam for root from 192.168.0.245 port 34399 ssh2 Feb 14 15:38:46 moatmonster sshd(pam_unix)[9886]: session opened for user root by root(uid=0) Feb 14 15:40:01 moatmonster cron[9895]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons ) Feb 14 15:50:01 moatmonster cron[9921]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons ) Feb 14 15:50:46 moatmonster sshd[9932]: Accepted keyboard-interactive/pam for root from 192.168.0.43 port 2721 ssh2 Feb 14 15:50:46 moatmonster sshd(pam_unix)[9937]: session opened for user root by root(uid=0) Feb 14 16:00:01 moatmonster cron[9950]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons ) Feb 14 16:00:01 moatmonster cron[9952]: (root) CMD (rm -f /var/spool/cron/lastrun/cron.hourly) Feb 14 16:00:10 moatmonster snort[9359]: Final Flow Statistics Feb 14 16:00:10 moatmonster snort[9359]: Frag3 statistics: Feb 14 16:00:10 moatmonster snort[9359]: Total Fragments: 2 Feb 14 16:00:10 moatmonster snort[9359]: Frags Reassembled: 1 Feb 14 16:00:10 moatmonster snort[9359]: Discards: 0 Feb 14 16:00:10 moatmonster snort[9359]: Memory Faults: 0 Feb 14 16:00:10 moatmonster snort[9359]: Timeouts: 0 Feb 14 16:00:10 moatmonster snort[9359]: Overlaps: 0 Feb 14 16:00:10 moatmonster snort[9359]: Anomalies: 0 Feb 14 16:00:10 moatmonster snort[9359]: Alerts: 0 Feb 14 16:00:10 moatmonster snort[9359]: FragTrackers Added: 1 Feb 14 16:00:10 moatmonster snort[9359]: FragTrackers Dumped: 1 Feb 14 16:00:10 moatmonster snort[9359]: FragTrackers Auto Freed: 0 Feb 14 16:00:10 moatmonster snort[9359]: Frag Nodes Inserted: 2 Feb 14 16:00:10 moatmonster snort[9359]: Frag Nodes Deleted: 2 Feb 14 16:00:10 moatmonster snort[9359]: =============================================================================== Feb 14 16:00:10 moatmonster device eth0 left promiscuous mode Feb 14 16:00:10 moatmonster audit(1171486810.651:9): dev=eth0 prom=0 old_prom=256 auid=4294967295 Feb 14 16:00:10 moatmonster snort[9359]: Snort exiting Feb 14 16:00:10 moatmonster device eth0 entered promiscuous mode Feb 14 16:00:10 moatmonster audit(1171486810.815:10): dev=eth0 prom=256 old_prom=0 auid=4294967295 Feb 14 16:00:10 moatmonster snort: OpenPcap() device eth0 network lookup: eth0: no IPv4 address assigned Feb 14 16:00:10 moatmonster snort[10031]: Initializing daemon mode Feb 14 16:00:10 moatmonster snort[10032]: PID path stat checked out ok, PID path set to /var/run/ Feb 14 16:00:10 moatmonster snort[10032]: Writing PID "10032" to file "/var/run//snort_eth0.pid" Feb 14 16:00:10 moatmonster snort[10032]: Parsing Rules file /etc/snort/snort.conf Feb 14 16:00:10 moatmonster snort[10032]: ,-----------[Flow Config]---------------------- Feb 14 16:00:10 moatmonster snort[10032]: | Stats Interval: 0 Feb 14 16:00:10 moatmonster snort[10032]: | Hash Method: 2 Feb 14 16:00:10 moatmonster snort[10032]: | Memcap: 10485760 Feb 14 16:00:10 moatmonster snort[10032]: | Rows : 4099 Feb 14 16:00:10 moatmonster snort[10032]: | Overhead Bytes: 16400(%0.16) Feb 14 16:00:10 moatmonster snort[10032]: `---------------------------------------------- Feb 14 16:00:10 moatmonster snort[10032]: Frag3 global config: Feb 14 16:00:10 moatmonster snort[10032]: Max frags: 65536 Feb 14 16:00:10 moatmonster snort[10032]: Fragment memory cap: 4194304 bytes Feb 14 16:00:10 moatmonster snort[10032]: Frag3 engine config: Feb 14 16:00:10 moatmonster snort[10032]: Target-based policy: FIRST Feb 14 16:00:10 moatmonster snort[10032]: Fragment timeout: 60 seconds Feb 14 16:00:10 moatmonster snort[10032]: Fragment min_ttl: 1 Feb 14 16:00:10 moatmonster snort[10032]: Fragment ttl_limit: 5 Feb 14 16:00:10 moatmonster snort[10032]: Fragment Problems: 1 Feb 14 16:00:10 moatmonster snort[10032]: Bound Addresses: 0.0.0.0/0.0.0.0 Feb 14 16:00:10 moatmonster snort[10032]: Stream4 config: Feb 14 16:00:10 moatmonster snort[10032]: Stateful inspection: ACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Session statistics: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Session timeout: 30 seconds Feb 14 16:00:10 moatmonster snort[10032]: Session memory cap: 8388608 bytes Feb 14 16:00:10 moatmonster snort[10032]: Session count max: 8192 sessions Feb 14 16:00:10 moatmonster snort[10032]: Session cleanup count: 5 Feb 14 16:00:10 moatmonster snort[10032]: State alerts: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Evasion alerts: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Scan alerts: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Log Flushed Streams: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: MinTTL: 1 Feb 14 16:00:10 moatmonster snort[10032]: TTL Limit: 5 Feb 14 16:00:10 moatmonster snort[10032]: Async Link: 0 Feb 14 16:00:10 moatmonster snort[10032]: State Protection: 0 Feb 14 16:00:10 moatmonster snort[10032]: Self preservation threshold: 50 Feb 14 16:00:10 moatmonster snort[10032]: Self preservation period: 90 Feb 14 16:00:10 moatmonster snort[10032]: Suspend threshold: 200 Feb 14 16:00:10 moatmonster snort[10032]: Suspend period: 30 Feb 14 16:00:10 moatmonster snort[10032]: Enforce TCP State: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Midstream Drop Alerts: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Server Data Inspection Limit: -1 Feb 14 16:00:10 moatmonster snort[10032]: WARNING /etc/snort/snort.conf(372) => flush_behavior set in config file, using old static flushpoints (0) Feb 14 16:00:10 moatmonster snort[10032]: Stream4_reassemble config: Feb 14 16:00:10 moatmonster snort[10032]: Server reassembly: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Client reassembly: ACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Reassembler alerts: ACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Zero out flushed packets: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Flush stream on alert: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: flush_data_diff_size: 500 Feb 14 16:00:10 moatmonster snort[10032]: Reassembler Packet Preferance : Favor Old Feb 14 16:00:10 moatmonster snort[10032]: Packet Sequence Overlap Limit: -1 Feb 14 16:00:10 moatmonster snort[10032]: Flush behavior: Small (<255 bytes) Feb 14 16:00:10 moatmonster snort[10032]: Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 Feb 14 16:00:10 moatmonster snort[10032]: Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 Feb 14 16:00:10 moatmonster snort[10032]: WARNING /etc/snort/snort.conf(373) => flush_behavior set in config file, using old static flushpoints (0) Feb 14 16:00:10 moatmonster snort[10032]: Stream4_reassemble config: Feb 14 16:00:10 moatmonster snort[10032]: Server reassembly: ACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Client reassembly: ACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Reassembler alerts: ACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Zero out flushed packets: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: Flush stream on alert: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: flush_data_diff_size: 500 Feb 14 16:00:10 moatmonster snort[10032]: Reassembler Packet Preferance : Favor Old Feb 14 16:00:10 moatmonster snort[10032]: Packet Sequence Overlap Limit: -1 Feb 14 16:00:10 moatmonster snort[10032]: Flush behavior: Small (<255 bytes) Feb 14 16:00:10 moatmonster snort[10032]: Ports: 21 23 25 53 80 110 111 139 143 445 513 1433 Feb 14 16:00:10 moatmonster snort[10032]: Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 Feb 14 16:00:10 moatmonster snort[10032]: HttpInspect Config: Feb 14 16:00:10 moatmonster snort[10032]: GLOBAL CONFIG Feb 14 16:00:10 moatmonster snort[10032]: Max Pipeline Requests: 0 Feb 14 16:00:10 moatmonster snort[10032]: Inspection Type: STATELESS Feb 14 16:00:10 moatmonster snort[10032]: Detect Proxy Usage: NO Feb 14 16:00:10 moatmonster snort[10032]: IIS Unicode Map Filename: /etc/snort/unicode.map Feb 14 16:00:10 moatmonster snort[10032]: IIS Unicode Map Codepage: 1252 Feb 14 16:00:10 moatmonster snort[10032]: rpc_decode arguments: Feb 14 16:00:10 moatmonster snort[10032]: Ports to decode RPC on: 111 32771 Feb 14 16:00:10 moatmonster snort[10032]: alert_fragments: INACTIVE Feb 14 16:00:10 moatmonster snort[10032]: alert_large_fragments: ACTIVE Feb 14 16:00:10 moatmonster snort[10032]: alert_incomplete: ACTIVE Feb 14 16:00:10 moatmonster snort[10032]: alert_multiple_requests: ACTIVE Feb 14 16:00:10 moatmonster snort[10032]: telnet_decode arguments: Feb 14 16:00:10 moatmonster snort[10032]: Ports to decode telnet on: 21 23 25 119 Feb 14 16:00:10 moatmonster snort[10032]: Portscan Detection Config: Feb 14 16:00:10 moatmonster snort[10032]: Detect Protocols: TCP UDP ICMP IP Feb 14 16:00:10 moatmonster snort[10032]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Feb 14 16:00:10 moatmonster snort[10032]: Sensitivity Level: Low Feb 14 16:00:10 moatmonster snort[10032]: Memcap (in bytes): 10000000 Feb 14 16:00:10 moatmonster snort[10032]: Number of Nodes: 36900 Feb 14 16:00:10 moatmonster snort[10032]: Feb 14 16:00:10 moatmonster snort[10032]: X-Link2State Config: Feb 14 16:00:10 moatmonster snort[10032]: Ports: 25 691 Feb 14 16:00:11 moatmonster snort[10032]: Warning: flowbits key 'dce.bind.netware_cs' is checked but not ever set. Feb 14 16:00:11 moatmonster snort[10032]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set. Feb 14 16:00:11 moatmonster snort[10032]: Warning: flowbits key 'realplayer.playlist' is checked but not ever set. Feb 14 16:00:11 moatmonster snort[10032]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked. Feb 14 16:00:11 moatmonster snort[10032]: Feb 14 16:00:11 moatmonster snort[10032]: +-----------------------[thresholding-config]---------------------------------- Feb 14 16:00:11 moatmonster snort[10032]: | memory-cap : 1048576 bytes Feb 14 16:00:11 moatmonster snort[10032]: +-----------------------[thresholding-global]---------------------------------- Feb 14 16:00:11 moatmonster snort[10032]: | none Feb 14 16:00:11 moatmonster snort[10032]: +-----------------------[thresholding-local]----------------------------------- Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=5322 type=Limit tracking=src count=1 seconds=60 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3543 type=Threshold tracking=src count=5 seconds=2 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=5321 type=Limit tracking=src count=1 seconds=60 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=5323 type=Limit tracking=src count=1 seconds=60 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=4984 type=Threshold tracking=src count=5 seconds=2 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3527 type=Limit tracking=dst count=5 seconds=60 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60 Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3542 type=Threshold tracking=src count=5 seconds=2 Feb 14 16:00:11 moatmonster snort[10032]: +-----------------------[suppression]------------------------------------------ Feb 14 16:00:11 moatmonster snort[10032]: | none Feb 14 16:00:11 moatmonster snort[10032]: ------------------------------------------------------------------------------- Feb 14 16:00:11 moatmonster snort[10032]: Rule application order: ->activation->dynamic->drop->alert->pass->log Feb 14 16:00:11 moatmonster snort[10032]: Log directory = /var/log/snort Feb 14 16:00:11 moatmonster snort[10032]: Snort initialization completed successfully (pid=10032)