---------- May 8 04:50:00 darknessmind snort[18220]: | Stats Interval: 0 May 8 04:50:00 darknessmind snort[18220]: | Hash Method: 2 May 8 04:50:00 darknessmind snort[18220]: | Memcap: 10485760 May 8 04:50:00 darknessmind snort[18220]: | Rows : 4099 May 8 04:50:00 darknessmind snort[18220]: | Overhead Bytes: 16400(%0.16) May 8 04:50:00 darknessmind snort[18220]: `---------------------------------------------- May 8 04:50:00 darknessmind snort[18220]: Frag3 global config: May 8 04:50:00 darknessmind snort[18220]: Max frags: 65536 May 8 04:50:00 darknessmind snort[18220]: Fragment memory cap: 4194304 bytes May 8 04:50:00 darknessmind snort[18220]: Frag3 engine config: May 8 04:50:00 darknessmind snort[18220]: Target-based policy: FIRST May 8 04:50:00 darknessmind snort[18220]: Fragment timeout: 60 seconds May 8 04:50:00 darknessmind snort[18220]: Fragment min_ttl: 1 May 8 04:50:00 darknessmind snort[18220]: Fragment ttl_limit: 5 May 8 04:50:00 darknessmind snort[18220]: Fragment Problems: 1 May 8 04:50:00 darknessmind snort[18220]: Bound Addresses: 0.0.0.0/0.0.0.0 May 8 04:50:00 darknessmind snort[18220]: Stream4 config: May 8 04:50:00 darknessmind snort[18220]: Stateful inspection: ACTIVE May 8 04:50:00 darknessmind snort[18220]: Session statistics: INACTIVE May 8 04:50:00 darknessmind snort[18220]: Session timeout: 30 seconds May 8 04:50:00 darknessmind snort[18220]: Session memory cap: 8388608 bytes May 8 04:50:00 darknessmind snort[18220]: Session count max: 8192 sessions May 8 04:50:00 darknessmind snort[18220]: Session cleanup count: 5 May 8 04:50:00 darknessmind snort[18220]: State alerts: INACTIVE May 8 04:50:00 darknessmind snort[18220]: Evasion alerts: INACTIVE May 8 04:50:00 darknessmind snort[18220]: Scan alerts: INACTIVE May 8 04:50:00 darknessmind snort[18220]: Log Flushed Streams: INACTIVE May 8 04:50:00 darknessmind snort[18220]: MinTTL: 1 May 8 04:50:00 darknessmind snort[18220]: TTL Limit: 5 May 8 04:50:00 darknessmind snort[18220]: Async Link: 0 May 8 04:50:00 darknessmind snort[18220]: State Protection: 0 May 8 04:50:00 darknessmind snort[18220]: Self preservation threshold: 50 May 8 04:50:00 darknessmind snort[18220]: Self preservation period: 90 May 8 04:50:00 darknessmind snort[18220]: Suspend threshold: 200 May 8 04:50:00 darknessmind snort[18220]: Suspend period: 30 May 8 04:50:00 darknessmind snort[18220]: Enforce TCP State: INACTIVE May 8 04:50:00 darknessmind snort[18220]: Midstream Drop Alerts: INACTIVE May 8 04:50:00 darknessmind snort[18220]: Server Data Inspection Limit: -1 May 8 04:50:00 darknessmind snort[18220]: WARNING /etc/snort/snort.conf(408) => flush_behavior set in config file, using old static flushpoints (0) May 8 04:50:00 darknessmind snort[18220]: Stream4_reassemble config: May 8 04:50:00 darknessmind snort[18220]: Server reassembly: INACTIVE May 8 04:50:00 darknessmind snort[18220]: Client reassembly: ACTIVE May 8 04:50:00 darknessmind snort[18220]: Reassembler alerts: ACTIVE May 8 04:50:00 darknessmind snort[18220]: Zero out flushed packets: INACTIVE May 8 04:50:00 darknessmind snort[18220]: Flush stream on alert: INACTIVE May 8 04:50:00 darknessmind snort[18220]: flush_data_diff_size: 500 May 8 04:50:00 darknessmind snort[18220]: Reassembler Packet Preferance : Favor Old May 8 04:50:00 darknessmind snort[18220]: Packet Sequence Overlap Limit: -1 May 8 04:50:00 darknessmind snort[18220]: Flush behavior: Small (<255 bytes) May 8 04:50:00 darknessmind snort[18220]: Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 May 8 04:50:00 darknessmind snort[18220]: Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 May 8 04:50:00 darknessmind snort[18220]: HttpInspect Config: May 8 04:50:00 darknessmind snort[18220]: GLOBAL CONFIG May 8 04:50:00 darknessmind snort[18220]: Max Pipeline Requests: 0 May 8 04:50:00 darknessmind snort[18220]: Inspection Type: STATELESS May 8 04:50:00 darknessmind snort[18220]: Detect Proxy Usage: NO May 8 04:50:00 darknessmind snort[18220]: IIS Unicode Map Filename: /etc/snort/unicode.map May 8 04:50:00 darknessmind snort[18220]: IIS Unicode Map Codepage: 1252 May 8 04:50:00 darknessmind snort[18220]: DEFAULT SERVER CONFIG: May 8 04:50:00 darknessmind snort[18220]: Ports: 80 8080 8180 May 8 04:50:00 darknessmind snort[18220]: Flow Depth: 300 May 8 04:50:00 darknessmind snort[18220]: Max Chunk Length: 500000 May 8 04:50:00 darknessmind snort[18220]: Inspect Pipeline Requests: YES May 8 04:50:00 darknessmind snort[18220]: URI Discovery Strict Mode: NO May 8 04:50:00 darknessmind snort[18220]: Allow Proxy Usage: NO May 8 04:50:00 darknessmind snort[18220]: Disable Alerting: NO May 8 04:50:00 darknessmind snort[18220]: Oversize Dir Length: 500 May 8 04:50:00 darknessmind snort[18220]: Only inspect URI: NO May 8 04:50:00 darknessmind snort[18220]: Ascii: YES alert: NO May 8 04:50:00 darknessmind snort[18220]: Double Decoding: YES alert: YES May 8 04:50:00 darknessmind snort[18220]: %U Encoding: YES alert: YES May 8 04:50:00 darknessmind snort[18220]: Bare Byte: YES alert: YES May 8 04:50:00 darknessmind snort[18220]: Base36: OFF May 8 04:50:00 darknessmind snort[18220]: UTF 8: OFF May 8 04:50:00 darknessmind snort[18220]: IIS Unicode: YES alert: YES May 8 04:50:00 darknessmind snort[18220]: Multiple Slash: YES alert: NO May 8 04:50:00 darknessmind snort[18220]: IIS Backslash: YES alert: NO May 8 04:50:00 darknessmind snort[18220]: Directory Traversal: YES alert: NO May 8 04:50:00 darknessmind snort[18220]: Web Root Traversal: YES alert: YES May 8 04:50:00 darknessmind snort[18220]: Apache WhiteSpace: YES alert: NO May 8 04:50:00 darknessmind snort[18220]: IIS Delimiter: YES alert: NO May 8 04:50:00 darknessmind snort[18220]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG May 8 04:50:00 darknessmind snort[18220]: Non-RFC Compliant Characters: NONE May 8 04:50:00 darknessmind snort[18220]: rpc_decode arguments: May 8 04:50:00 darknessmind snort[18220]: Ports to decode RPC on: 111 32771 May 8 04:50:00 darknessmind snort[18220]: alert_fragments: INACTIVE May 8 04:50:00 darknessmind snort[18220]: alert_large_fragments: ACTIVE May 8 04:50:00 darknessmind snort[18220]: alert_incomplete: ACTIVE May 8 04:50:00 darknessmind snort[18220]: alert_multiple_requests: ACTIVE May 8 04:50:00 darknessmind snort[18220]: Portscan Detection Config: May 8 04:50:00 darknessmind snort[18220]: Detect Protocols: TCP UDP ICMP IP May 8 04:50:00 darknessmind snort[18220]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan May 8 04:50:00 darknessmind snort[18220]: Sensitivity Level: Low May 8 04:50:00 darknessmind snort[18220]: Memcap (in bytes): 10000000 May 8 04:50:00 darknessmind snort[18220]: Number of Nodes: 36900 May 8 04:50:00 darknessmind snort[18220]: May 8 04:50:00 darknessmind snort[18220]: Tagged Packet Limit: 256 May 8 04:50:00 darknessmind snort[18220]: May 8 04:50:00 darknessmind snort[18220]: +-----------------------[thresholding-config]---------------------------------- May 8 04:50:00 darknessmind snort[18220]: | memory-cap : 1048576 bytes May 8 04:50:00 darknessmind snort[18220]: +-----------------------[thresholding-global]---------------------------------- May 8 04:50:00 darknessmind snort[18220]: | none May 8 04:50:00 darknessmind snort[18220]: +-----------------------[thresholding-local]----------------------------------- May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60 May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60 May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60 May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60 May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2 May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60 May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10 May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2 May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60 May 8 04:50:00 darknessmind snort[18220]: +-----------------------[suppression]------------------------------------------ May 8 04:50:00 darknessmind snort[18220]: | none May 8 04:50:00 darknessmind snort[18220]: ------------------------------------------------------------------------------- May 8 04:50:00 darknessmind snort[18220]: Rule application order: ->activation->dynamic->pass->drop->alert->log May 8 04:50:00 darknessmind snort[18220]: Log directory = /var/log/snort May 8 04:50:00 darknessmind snort[18220]: Loading dynamic engine /usr/lib/snort/dynamicengine/libsf_engine.so... May 8 04:50:00 darknessmind snort[18220]: done May 8 04:50:00 darknessmind snort[18220]: Loading all dynamic preprocessor libs from /usr/lib/snort/dynamicpreprocessor/... May 8 04:50:00 darknessmind snort[18220]: Loading dynamic preprocessor library /usr/lib/snort/dynamicpreprocessor//libsf_ftptelnet_preproc.so... May 8 04:50:00 darknessmind snort[18220]: done May 8 04:50:00 darknessmind snort[18220]: Loading dynamic preprocessor library /usr/lib/snort/dynamicpreprocessor//libsf_smtp_preproc.so... May 8 04:50:00 darknessmind snort[18220]: done May 8 04:50:00 darknessmind snort[18220]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort/dynamicpreprocessor/ May 8 04:50:00 darknessmind snort[18220]: FTPTelnet Config: May 8 04:50:00 darknessmind snort[18220]: GLOBAL CONFIG May 8 04:50:00 darknessmind snort[18220]: Inspection Type: stateful May 8 04:50:00 darknessmind snort[18220]: Check for Encrypted Traffic: YES alert: YES May 8 04:50:00 darknessmind snort[18220]: Continue to check encrypted data: NO May 8 04:50:00 darknessmind snort[18220]: TELNET CONFIG: May 8 04:50:00 darknessmind snort[18220]: Ports: 23 May 8 04:50:00 darknessmind snort[18220]: Are You There Threshold: 200 May 8 04:50:00 darknessmind snort[18220]: Normalize: YES May 8 04:50:00 darknessmind snort[18220]: FTP CONFIG: May 8 04:50:00 darknessmind snort[18220]: FTP Server: default May 8 04:50:00 darknessmind snort[18220]: Ports: 21 May 8 04:50:00 darknessmind snort[18220]: Check for Telnet Cmds: YES alert: YES May 8 04:50:00 darknessmind snort[18220]: Identify open data channels: YES May 8 04:50:00 darknessmind snort[18220]: FTP Client: default May 8 04:50:00 darknessmind snort[18220]: Check for Bounce Attacks: YES alert: YES May 8 04:50:00 darknessmind snort[18220]: Check for Telnet Cmds: YES alert: YES May 8 04:50:00 darknessmind snort[18220]: Max Response Length: 256 May 8 04:50:00 darknessmind snort[18220]: SMTP Config: May 8 04:50:00 darknessmind snort[18220]: Ports: May 8 04:50:00 darknessmind snort[18220]: 25 May 8 04:50:00 darknessmind snort[18220]: May 8 04:50:00 darknessmind snort[18220]: Inspection Type: STATEFUL May 8 04:50:00 darknessmind snort[18220]: Normalize Spaces: YES May 8 04:50:00 darknessmind snort[18220]: Ignore Data: NO May 8 04:50:00 darknessmind snort[18220]: Ignore TLS Data: NO May 8 04:50:00 darknessmind snort[18220]: Ignore Alerts: NO May 8 04:50:00 darknessmind snort[18220]: Max Command Length: 0 May 8 04:50:00 darknessmind snort[18220]: Max Header Line Length: 0 May 8 04:50:00 darknessmind snort[18220]: Max Response Line Length: 0 May 8 04:50:00 darknessmind snort[18220]: X-Link2State Alert: YES May 8 04:50:00 darknessmind snort[18220]: Drop on X-Link2State Alert: NO May 8 04:50:00 darknessmind snort[18220]: Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked. May 8 04:50:00 darknessmind snort[18220]: Warning: flowbits key 'realplayer.playlist' is checked but not ever set. May 8 04:50:00 darknessmind snort[18220]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set. May 8 04:50:00 darknessmind snort[18220]: Var 'eth0_ADDRESS' defined, value len = 25 chars May 8 04:50:00 darknessmind snort[18220]: , value = 192.168.0.0/255.255.255.0 May 8 04:50:01 darknessmind snort[18220]: Initializing daemon mode May 8 04:50:01 darknessmind snort[18221]: Var 'eth0_ADDRESS' redefined May 8 04:50:01 darknessmind snort[18221]: PID path stat checked out ok, PID path set to /var/run/ May 8 04:50:01 darknessmind snort[18221]: Writing PID "18221" to file "/var/run//snort_eth0.pid" May 8 04:50:01 darknessmind snort[18221]: Daemon initialized May 8 04:50:01 darknessmind snort[18220]: Daemon parent exiting May 8 04:50:01 darknessmind snort[18257]: Parsing Rules file /etc/snort/snort.conf May 8 04:50:01 darknessmind snort[18257]: Var 'EXTERNAL_NET' defined, value len = 3 chars May 8 04:50:01 darknessmind snort[18257]: , value = any May 8 04:50:01 darknessmind snort[18257]: Var 'DNS_SERVERS' defined, value len = 3 chars May 8 04:50:01 darknessmind snort[18257]: , value = any May 8 04:50:01 darknessmind snort[18257]: Var 'SMTP_SERVERS' defined, value len = 3 chars May 8 04:50:01 darknessmind snort[18257]: , value = any May 8 04:50:01 darknessmind snort[18257]: Var 'HTTP_SERVERS' defined, value len = 3 chars May 8 04:50:01 darknessmind snort[18257]: , value = any May 8 04:50:01 darknessmind snort[18257]: Var 'SQL_SERVERS' defined, value len = 3 chars May 8 04:50:01 darknessmind snort[18257]: , value = any May 8 04:50:01 darknessmind snort[18257]: Var 'TELNET_SERVERS' defined, value len = 3 chars May 8 04:50:01 darknessmind snort[18257]: , value = any May 8 04:50:01 darknessmind snort[18257]: Var 'SNMP_SERVERS' defined, value len = 3 chars May 8 04:50:01 darknessmind snort[18257]: , value = any May 8 04:50:01 darknessmind snort[18257]: Var 'HTTP_PORTS' defined, value len = 2 chars May 8 04:50:01 darknessmind snort[18257]: , value = 80 May 8 04:50:01 darknessmind snort[18257]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars May 8 04:50:01 darknessmind snort[18257]: , value = !80 May 8 04:50:01 darknessmind snort[18257]: Var 'ORACLE_PORTS' defined, value len = 4 chars May 8 04:50:01 darknessmind snort[18257]: , value = 1521 May 8 04:50:01 darknessmind snort[18257]: Var 'AIM_SERVERS' defined, value len = 185 chars May 8 04:50:01 darknessmind snort[18257]: May 8 04:50:01 darknessmind snort[18257]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 May 8 04:50:01 darknessmind snort[18257]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] May 8 04:50:01 darknessmind snort[18257]: Var 'RULE_PATH' defined, value len = 5 chars May 8 04:50:01 darknessmind snort[18257]: , value = rules May 8 04:50:01 darknessmind snort[18257]: ,-----------[Flow Config]---------------------- May 8 04:50:01 darknessmind snort[18257]: | Stats Interval: 0 May 8 04:50:01 darknessmind snort[18257]: | Hash Method: 2 May 8 04:50:01 darknessmind snort[18257]: | Memcap: 10485760 May 8 04:50:01 darknessmind snort[18257]: | Rows : 4099 May 8 04:50:01 darknessmind snort[18257]: | Overhead Bytes: 16400(%0.16) May 8 04:50:01 darknessmind snort[18257]: `---------------------------------------------- May 8 04:50:01 darknessmind snort[18257]: Frag3 global config: May 8 04:50:01 darknessmind snort[18257]: Max frags: 65536 May 8 04:50:01 darknessmind snort[18257]: Fragment memory cap: 4194304 bytes May 8 04:50:01 darknessmind snort[18257]: Frag3 engine config: May 8 04:50:01 darknessmind snort[18257]: Target-based policy: FIRST May 8 04:50:01 darknessmind snort[18257]: Fragment timeout: 60 seconds May 8 04:50:01 darknessmind snort[18257]: Fragment min_ttl: 1 May 8 04:50:01 darknessmind snort[18257]: Fragment ttl_limit: 5 May 8 04:50:01 darknessmind snort[18257]: Fragment Problems: 1 May 8 04:50:01 darknessmind snort[18257]: Bound Addresses: 0.0.0.0/0.0.0.0 May 8 04:50:01 darknessmind snort[18257]: Stream4 config: May 8 04:50:01 darknessmind snort[18257]: Stateful inspection: ACTIVE May 8 04:50:01 darknessmind snort[18257]: Session statistics: INACTIVE May 8 04:50:01 darknessmind snort[18257]: Session timeout: 30 seconds May 8 04:50:01 darknessmind snort[18257]: Session memory cap: 8388608 bytes May 8 04:50:01 darknessmind snort[18257]: Session count max: 8192 sessions May 8 04:50:01 darknessmind snort[18257]: Session cleanup count: 5 May 8 04:50:01 darknessmind snort[18257]: State alerts: INACTIVE May 8 04:50:01 darknessmind snort[18257]: Evasion alerts: INACTIVE May 8 04:50:01 darknessmind snort[18257]: Scan alerts: INACTIVE May 8 04:50:01 darknessmind snort[18257]: Log Flushed Streams: INACTIVE May 8 04:50:01 darknessmind snort[18257]: MinTTL: 1 May 8 04:50:01 darknessmind snort[18257]: TTL Limit: 5 May 8 04:50:01 darknessmind snort[18257]: Async Link: 0 May 8 04:50:01 darknessmind snort[18257]: State Protection: 0 May 8 04:50:01 darknessmind snort[18257]: Self preservation threshold: 50 May 8 04:50:01 darknessmind snort[18257]: Self preservation period: 90 May 8 04:50:01 darknessmind snort[18257]: Suspend threshold: 200 May 8 04:50:01 darknessmind snort[18257]: Suspend period: 30 May 8 04:50:01 darknessmind snort[18257]: Enforce TCP State: INACTIVE May 8 04:50:01 darknessmind snort[18257]: Midstream Drop Alerts: INACTIVE May 8 04:50:01 darknessmind snort[18257]: Server Data Inspection Limit: -1 May 8 04:50:01 darknessmind snort[18257]: WARNING /etc/snort/snort.conf(408) => flush_behavior set in config file, using old static flushpoints (0) May 8 04:50:01 darknessmind snort[18257]: Stream4_reassemble config: May 8 04:50:01 darknessmind snort[18257]: Server reassembly: INACTIVE May 8 04:50:01 darknessmind snort[18257]: Client reassembly: ACTIVE May 8 04:50:01 darknessmind snort[18257]: Reassembler alerts: ACTIVE May 8 04:50:01 darknessmind snort[18257]: Zero out flushed packets: INACTIVE May 8 04:50:01 darknessmind snort[18257]: Flush stream on alert: INACTIVE May 8 04:50:01 darknessmind snort[18257]: flush_data_diff_size: 500 May 8 04:50:01 darknessmind snort[18257]: Reassembler Packet Preferance : Favor Old May 8 04:50:01 darknessmind snort[18257]: Packet Sequence Overlap Limit: -1 May 8 04:50:01 darknessmind snort[18257]: Flush behavior: Small (<255 bytes) May 8 04:50:01 darknessmind snort[18257]: Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 May 8 04:50:01 darknessmind snort[18257]: Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306 May 8 04:50:01 darknessmind snort[18257]: HttpInspect Config: May 8 04:50:01 darknessmind snort[18257]: GLOBAL CONFIG May 8 04:50:01 darknessmind snort[18257]: Max Pipeline Requests: 0 May 8 04:50:01 darknessmind snort[18257]: Inspection Type: STATELESS May 8 04:50:01 darknessmind snort[18257]: Detect Proxy Usage: NO May 8 04:50:01 darknessmind snort[18257]: IIS Unicode Map Filename: /etc/snort/unicode.map May 8 04:50:01 darknessmind snort[18257]: IIS Unicode Map Codepage: 1252 May 8 04:50:01 darknessmind snort[18257]: DEFAULT SERVER CONFIG: May 8 04:50:01 darknessmind snort[18257]: Ports: 80 8080 8180 May 8 04:50:01 darknessmind snort[18257]: Flow Depth: 300 May 8 04:50:01 darknessmind snort[18257]: Max Chunk Length: 500000 May 8 04:50:01 darknessmind snort[18257]: Inspect Pipeline Requests: YES May 8 04:50:01 darknessmind snort[18257]: URI Discovery Strict Mode: NO May 8 04:50:01 darknessmind snort[18257]: Allow Proxy Usage: NO May 8 04:50:01 darknessmind snort[18257]: Disable Alerting: NO May 8 04:50:01 darknessmind snort[18257]: Oversize Dir Length: 500 May 8 04:50:01 darknessmind snort[18257]: Only inspect URI: NO May 8 04:50:01 darknessmind snort[18257]: Ascii: YES alert: NO May 8 04:50:01 darknessmind snort[18257]: Double Decoding: YES alert: YES May 8 04:50:01 darknessmind snort[18257]: %U Encoding: YES alert: YES May 8 04:50:01 darknessmind snort[18257]: Bare Byte: YES alert: YES May 8 04:50:01 darknessmind snort[18257]: Base36: OFF May 8 04:50:01 darknessmind snort[18257]: UTF 8: OFF May 8 04:50:01 darknessmind snort[18257]: IIS Unicode: YES alert: YES May 8 04:50:01 darknessmind snort[18257]: Multiple Slash: YES alert: NO May 8 04:50:01 darknessmind snort[18257]: IIS Backslash: YES alert: NO May 8 04:50:01 darknessmind snort[18257]: Directory Traversal: YES alert: NO May 8 04:50:01 darknessmind snort[18257]: Web Root Traversal: YES alert: YES May 8 04:50:01 darknessmind snort[18257]: Apache WhiteSpace: YES alert: NO May 8 04:50:01 darknessmind snort[18257]: IIS Delimiter: YES alert: NO May 8 04:50:01 darknessmind snort[18257]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG May 8 04:50:01 darknessmind snort[18257]: Non-RFC Compliant Characters: NONE May 8 04:50:01 darknessmind snort[18257]: rpc_decode arguments: May 8 04:50:01 darknessmind snort[18257]: Ports to decode RPC on: 111 32771 May 8 04:50:01 darknessmind snort[18257]: alert_fragments: INACTIVE May 8 04:50:01 darknessmind snort[18257]: alert_large_fragments: ACTIVE May 8 04:50:01 darknessmind snort[18257]: alert_incomplete: ACTIVE May 8 04:50:01 darknessmind snort[18257]: alert_multiple_requests: ACTIVE May 8 04:50:02 darknessmind snort[18257]: Portscan Detection Config: May 8 04:50:02 darknessmind snort[18257]: Detect Protocols: TCP UDP ICMP IP May 8 04:50:02 darknessmind snort[18257]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan May 8 04:50:02 darknessmind snort[18257]: Sensitivity Level: Low May 8 04:50:02 darknessmind snort[18257]: Memcap (in bytes): 10000000 May 8 04:50:02 darknessmind snort[18257]: Number of Nodes: 36900 May 8 04:50:02 darknessmind snort[18257]: May 8 04:50:02 darknessmind snort[18257]: Tagged Packet Limit: 256 May 8 04:50:02 darknessmind snort[18257]: May 8 04:50:02 darknessmind snort[18257]: +-----------------------[thresholding-config]---------------------------------- May 8 04:50:02 darknessmind snort[18257]: | memory-cap : 1048576 bytes May 8 04:50:02 darknessmind snort[18257]: +-----------------------[thresholding-global]---------------------------------- May 8 04:50:02 darknessmind snort[18257]: | none May 8 04:50:02 darknessmind snort[18257]: +-----------------------[thresholding-local]----------------------------------- May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60 May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60 May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2 May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60 May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60 May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10 May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60 May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60 May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2 May 8 04:50:02 darknessmind snort[18257]: +-----------------------[suppression]------------------------------------------ May 8 04:50:02 darknessmind snort[18257]: | none May 8 04:50:02 darknessmind snort[18257]: ------------------------------------------------------------------------------- May 8 04:50:02 darknessmind snort[18257]: Rule application order: ->activation->dynamic->pass->drop->alert->log May 8 04:50:02 darknessmind snort[18257]: Log directory = /var/log/snort May 8 04:50:02 darknessmind snort[18257]: Loading dynamic engine /usr/lib/snort/dynamicengine/libsf_engine.so... May 8 04:50:02 darknessmind snort[18257]: done May 8 04:50:02 darknessmind snort[18257]: Loading all dynamic preprocessor libs from /usr/lib/snort/dynamicpreprocessor/... May 8 04:50:02 darknessmind snort[18257]: Loading dynamic preprocessor library /usr/lib/snort/dynamicpreprocessor//libsf_ftptelnet_preproc.so... May 8 04:50:02 darknessmind snort[18257]: done May 8 04:50:02 darknessmind snort[18257]: Loading dynamic preprocessor library /usr/lib/snort/dynamicpreprocessor//libsf_smtp_preproc.so... May 8 04:50:02 darknessmind snort[18257]: done May 8 04:50:02 darknessmind snort[18257]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort/dynamicpreprocessor/ May 8 04:50:02 darknessmind snort[18257]: FTPTelnet Config: May 8 04:50:02 darknessmind snort[18257]: GLOBAL CONFIG May 8 04:50:02 darknessmind snort[18257]: Inspection Type: stateful May 8 04:50:02 darknessmind snort[18257]: Check for Encrypted Traffic: YES alert: YES May 8 04:50:02 darknessmind snort[18257]: Continue to check encrypted data: NO May 8 04:50:02 darknessmind snort[18257]: TELNET CONFIG: May 8 04:50:02 darknessmind snort[18257]: Ports: 23 May 8 04:50:02 darknessmind snort[18257]: Are You There Threshold: 200 May 8 04:50:02 darknessmind snort[18257]: Normalize: YES May 8 04:50:02 darknessmind snort[18257]: FTP CONFIG: May 8 04:50:02 darknessmind snort[18257]: FTP Server: default May 8 04:50:02 darknessmind snort[18257]: Ports: 21 May 8 04:50:02 darknessmind snort[18257]: Check for Telnet Cmds: YES alert: YES May 8 04:50:02 darknessmind snort[18257]: Identify open data channels: YES May 8 04:50:02 darknessmind snort[18257]: FTP Client: default May 8 04:50:02 darknessmind snort[18257]: Check for Bounce Attacks: YES alert: YES May 8 04:50:02 darknessmind snort[18257]: Check for Telnet Cmds: YES alert: YES May 8 04:50:02 darknessmind snort[18257]: Max Response Length: 256 May 8 04:50:02 darknessmind snort[18257]: SMTP Config: May 8 04:50:02 darknessmind snort[18257]: Ports: May 8 04:50:02 darknessmind snort[18257]: 25 May 8 04:50:02 darknessmind snort[18257]: May 8 04:50:02 darknessmind snort[18257]: Inspection Type: STATEFUL May 8 04:50:02 darknessmind snort[18257]: Normalize Spaces: YES May 8 04:50:02 darknessmind snort[18257]: Ignore Data: NO May 8 04:50:02 darknessmind snort[18257]: Ignore TLS Data: NO May 8 04:50:02 darknessmind snort[18257]: Ignore Alerts: NO May 8 04:50:02 darknessmind snort[18257]: Max Command Length: 0 May 8 04:50:02 darknessmind snort[18257]: Max Header Line Length: 0 May 8 04:50:02 darknessmind snort[18257]: Max Response Line Length: 0 May 8 04:50:02 darknessmind snort[18257]: X-Link2State Alert: YES May 8 04:50:02 darknessmind snort[18257]: Drop on X-Link2State Alert: NO May 8 04:50:02 darknessmind snort[18257]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set. May 8 04:50:02 darknessmind snort[18257]: Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked. May 8 04:50:02 darknessmind snort[18257]: Warning: flowbits key 'realplayer.playlist' is checked but not ever set. May 8 04:50:02 darknessmind snort[18257]: Var 'eth0_ADDRESS' defined, value len = 25 chars May 8 04:50:02 darknessmind snort[18257]: , value = 192.168.0.0/255.255.255.0 May 8 04:50:02 darknessmind snort[18257]: Initializing daemon mode May 8 04:50:02 darknessmind snort[18258]: Var 'eth0_ADDRESS' redefined May 8 04:50:02 darknessmind snort[18258]: PID path stat checked out ok, PID path set to /var/run/ May 8 04:50:02 darknessmind snort[18258]: Writing PID "18258" to file "/var/run//snort_eth0.pid" May 8 04:50:02 darknessmind snort[18258]: Daemon initialized May 8 04:50:02 darknessmind snort[18257]: Daemon parent exiting [root@darknessmind var]# ll -h /var/log/daemons/ total 39M -rw------- 1 root root 1,2M mai 8 20:13 errors.1 -rw------- 1 root root 38M mai 8 04:50 info.1 -rw------- 1 root root 297 mai 7 09:35 warnings.1