Apr 24 14:30:16 huge snort[9957]: Var 'any_ADDRESS' defined, value len = 15 chars Apr 24 14:30:16 huge snort[9957]: , value = 0.0.0.0/0.0.0.0 Apr 24 14:30:16 huge snort[9957]: Var 'lo_ADDRESS' defined, value len = 19 chars Apr 24 14:30:16 huge snort[9957]: , value = 127.0.0.0/255.0.0.0 Apr 24 14:30:16 huge snort[9957]: Parsing Rules file /etc/snort/snort.conf Apr 24 14:30:16 huge snort[9957]: Var 'HOME_NET' defined, value len = 3 chars Apr 24 14:30:16 huge snort[9957]: , value = any Apr 24 14:30:16 huge snort[9957]: Var 'EXTERNAL_NET' defined, value len = 3 chars Apr 24 14:30:16 huge snort[9957]: , value = any Apr 24 14:30:16 huge snort[9957]: Var 'DNS_SERVERS' defined, value len = 3 chars Apr 24 14:30:16 huge snort[9957]: , value = any Apr 24 14:30:16 huge snort[9957]: Var 'SMTP_SERVERS' defined, value len = 3 chars Apr 24 14:30:16 huge snort[9957]: , value = any Apr 24 14:30:16 huge snort[9957]: Var 'HTTP_SERVERS' defined, value len = 3 chars Apr 24 14:30:16 huge snort[9957]: , value = any Apr 24 14:30:16 huge snort[9957]: Var 'SQL_SERVERS' defined, value len = 3 chars Apr 24 14:30:16 huge snort[9957]: , value = any Apr 24 14:30:16 huge snort[9957]: Var 'TELNET_SERVERS' defined, value len = 3 chars Apr 24 14:30:16 huge snort[9957]: , value = any Apr 24 14:30:16 huge snort[9957]: Var 'SNMP_SERVERS' defined, value len = 3 chars Apr 24 14:30:16 huge snort[9957]: , value = any Apr 24 14:30:16 huge snort[9957]: Var 'HTTP_PORTS' defined, value len = 2 chars Apr 24 14:30:16 huge snort[9957]: , value = 80 Apr 24 14:30:16 huge snort[9957]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Apr 24 14:30:16 huge snort[9957]: , value = !80 Apr 24 14:30:16 huge snort[9957]: Var 'ORACLE_PORTS' defined, value len = 4 chars Apr 24 14:30:16 huge snort[9957]: , value = 1521 Apr 24 14:30:16 huge snort[9957]: Var 'AIM_SERVERS' defined, value len = 185 chars Apr 24 14:30:16 huge snort[9957]: Apr 24 14:30:16 huge snort[9957]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Apr 24 14:30:16 huge snort[9957]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Apr 24 14:30:16 huge snort[9957]: Var 'RULE_PATH' defined, value len = 16 chars Apr 24 14:30:16 huge snort[9957]: , value = /etc/snort/rules Apr 24 14:30:16 huge snort[9957]: ,-----------[Flow Config]---------------------- Apr 24 14:30:16 huge snort[9957]: | Stats Interval: 0 Apr 24 14:30:16 huge snort[9957]: | Hash Method: 2 Apr 24 14:30:16 huge snort[9957]: | Memcap: 10485760 Apr 24 14:30:16 huge snort[9957]: | Rows : 4099 Apr 24 14:30:16 huge snort[9957]: | Overhead Bytes: 16400(%0.16) Apr 24 14:30:16 huge snort[9957]: `---------------------------------------------- Apr 24 14:30:16 huge snort[9957]: Frag3 global config: Apr 24 14:30:16 huge snort[9957]: Max frags: 65536 Apr 24 14:30:16 huge snort[9957]: Fragment memory cap: 4194304 bytes Apr 24 14:30:16 huge snort[9957]: Frag3 engine config: Apr 24 14:30:16 huge snort[9957]: Target-based policy: FIRST Apr 24 14:30:16 huge snort[9957]: Fragment timeout: 60 seconds Apr 24 14:30:16 huge snort[9957]: Fragment min_ttl: 1 Apr 24 14:30:16 huge snort[9957]: Fragment ttl_limit: 5 Apr 24 14:30:16 huge snort[9957]: Fragment Problems: 1 Apr 24 14:30:16 huge snort[9957]: Bound Addresses: 0.0.0.0/0.0.0.0 Apr 24 14:30:16 huge snort[9957]: Stream4 config: Apr 24 14:30:16 huge snort[9957]: Stateful inspection: ACTIVE Apr 24 14:30:16 huge snort[9957]: Session statistics: INACTIVE Apr 24 14:30:16 huge snort[9957]: Session timeout: 30 seconds Apr 24 14:30:16 huge snort[9957]: Session memory cap: 8388608 bytes Apr 24 14:30:16 huge snort[9957]: Session count max: 8192 sessions Apr 24 14:30:16 huge snort[9957]: Session cleanup count: 5 Apr 24 14:30:16 huge snort[9957]: State alerts: INACTIVE Apr 24 14:30:16 huge snort[9957]: Evasion alerts: INACTIVE Apr 24 14:30:16 huge snort[9957]: Scan alerts: INACTIVE Apr 24 14:30:16 huge snort[9957]: Log Flushed Streams: INACTIVE Apr 24 14:30:16 huge snort[9957]: MinTTL: 1 Apr 24 14:30:16 huge snort[9957]: TTL Limit: 5 Apr 24 14:30:16 huge snort[9957]: Async Link: 0 Apr 24 14:30:16 huge snort[9957]: State Protection: 0 Apr 24 14:30:16 huge snort[9957]: Self preservation threshold: 50 Apr 24 14:30:16 huge snort[9957]: Self preservation period: 90 Apr 24 14:30:16 huge snort[9957]: Suspend threshold: 200 Apr 24 14:30:16 huge snort[9957]: Suspend period: 30 Apr 24 14:30:16 huge snort[9957]: Enforce TCP State: INACTIVE Apr 24 14:30:16 huge snort[9957]: Midstream Drop Alerts: INACTIVE Apr 24 14:30:16 huge snort[9957]: Allow Blocking of TCP Sessions in Inline: ACTIVE Apr 24 14:30:16 huge snort[9957]: Server Data Inspection Limit: -1 Apr 24 14:30:16 huge snort[9957]: WARNING /etc/snort/snort.conf(439) => flush_behavior set in config file, using old static flushpoints (0) Apr 24 14:30:16 huge snort[9957]: Stream4_reassemble config: Apr 24 14:30:16 huge snort[9957]: Server reassembly: INACTIVE Apr 24 14:30:16 huge snort[9957]: Client reassembly: ACTIVE Apr 24 14:30:16 huge snort[9957]: Reassembler alerts: ACTIVE Apr 24 14:30:16 huge snort[9957]: Zero out flushed packets: INACTIVE Apr 24 14:30:16 huge snort[9957]: Flush stream on alert: INACTIVE Apr 24 14:30:16 huge snort[9957]: flush_data_diff_size: 500 Apr 24 14:30:16 huge snort[9957]: Reassembler Packet Preferance : Favor Old Apr 24 14:30:16 huge snort[9957]: Packet Sequence Overlap Limit: -1 Apr 24 14:30:16 huge snort[9957]: Flush behavior: Small (<255 bytes) Apr 24 14:30:16 huge snort[9957]: Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 Apr 24 14:30:16 huge snort[9957]: Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 Apr 24 14:30:16 huge snort[9957]: HttpInspect Config: Apr 24 14:30:16 huge snort[9957]: GLOBAL CONFIG Apr 24 14:30:16 huge snort[9957]: Max Pipeline Requests: 0 Apr 24 14:30:16 huge snort[9957]: Inspection Type: STATELESS Apr 24 14:30:16 huge snort[9957]: Detect Proxy Usage: NO Apr 24 14:30:16 huge snort[9957]: IIS Unicode Map Filename: /etc/snort/unicode.map Apr 24 14:30:16 huge snort[9957]: IIS Unicode Map Codepage: 1252 Apr 24 14:30:16 huge snort[9957]: DEFAULT SERVER CONFIG: Apr 24 14:30:16 huge snort[9957]: Server profile: All Apr 24 14:30:16 huge snort[9957]: Ports: 80 8080 8180 Apr 24 14:30:16 huge snort[9957]: Flow Depth: 300 Apr 24 14:30:16 huge snort[9957]: Max Chunk Length: 500000 Apr 24 14:30:16 huge snort[9957]: Inspect Pipeline Requests: YES Apr 24 14:30:16 huge snort[9957]: URI Discovery Strict Mode: NO Apr 24 14:30:16 huge snort[9957]: Allow Proxy Usage: NO Apr 24 14:30:16 huge snort[9957]: Disable Alerting: NO Apr 24 14:30:16 huge snort[9957]: Oversize Dir Length: 500 Apr 24 14:30:16 huge snort[9957]: Only inspect URI: NO Apr 24 14:30:16 huge snort[9957]: Ascii: YES alert: NO Apr 24 14:30:16 huge snort[9957]: Double Decoding: YES alert: YES Apr 24 14:30:16 huge snort[9957]: %U Encoding: YES alert: YES Apr 24 14:30:16 huge snort[9957]: Bare Byte: YES alert: YES Apr 24 14:30:16 huge snort[9957]: Base36: OFF Apr 24 14:30:16 huge snort[9957]: UTF 8: OFF Apr 24 14:30:16 huge snort[9957]: IIS Unicode: YES alert: YES Apr 24 14:30:16 huge snort[9957]: Multiple Slash: YES alert: NO Apr 24 14:30:16 huge snort[9957]: IIS Backslash: YES alert: NO Apr 24 14:30:16 huge snort[9957]: Directory Traversal: YES alert: NO Apr 24 14:30:16 huge snort[9957]: Web Root Traversal: YES alert: YES Apr 24 14:30:16 huge snort[9957]: Apache WhiteSpace: YES alert: NO Apr 24 14:30:16 huge snort[9957]: IIS Delimiter: YES alert: NO Apr 24 14:30:16 huge snort[9957]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Apr 24 14:30:16 huge snort[9957]: Non-RFC Compliant Characters: NONE Apr 24 14:30:16 huge snort[9957]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Apr 24 14:30:16 huge snort[9957]: rpc_decode arguments: Apr 24 14:30:16 huge snort[9957]: Ports to decode RPC on: 111 32771 Apr 24 14:30:16 huge snort[9957]: alert_fragments: INACTIVE Apr 24 14:30:16 huge snort[9957]: alert_large_fragments: ACTIVE Apr 24 14:30:16 huge snort[9957]: alert_incomplete: ACTIVE Apr 24 14:30:16 huge snort[9957]: alert_multiple_requests: ACTIVE Apr 24 14:30:16 huge snort[9957]: Portscan Detection Config: Apr 24 14:30:16 huge snort[9957]: Detect Protocols: TCP UDP ICMP IP Apr 24 14:30:16 huge snort[9957]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Apr 24 14:30:16 huge snort[9957]: Sensitivity Level: Low Apr 24 14:30:16 huge snort[9957]: Memcap (in bytes): 10000000 Apr 24 14:30:16 huge snort[9957]: Number of Nodes: 36900 Apr 24 14:30:16 huge snort[9957]: