Nov 17 13:10:37 nospam snort[32441]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 13:10:37 nospam snort[32441]: , value = 66.228.0.0/255.255.252.0 Nov 17 13:10:37 nospam snort[32441]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 13:10:37 nospam snort[32441]: , value = 192.168.1.0/255.255.255.0 Nov 17 13:10:37 nospam snort[32441]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 13:10:37 nospam snort[32441]: , value = 192.168.156.0/255.255.255.0 Nov 17 13:10:37 nospam snort[32441]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 13:10:37 nospam snort[32441]: , value = 192.168.150.0/255.255.255.0 Nov 17 13:10:37 nospam snort[32441]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 13:10:37 nospam snort[32441]: , value = 0.0.0.0/0.0.0.0 Nov 17 13:10:37 nospam snort[32441]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 13:10:37 nospam snort[32441]: , value = 127.0.0.0/255.0.0.0 Nov 17 13:10:37 nospam snort[32441]: Parsing Rules file /etc/snort/snort.conf Nov 17 13:10:37 nospam snort[32441]: Var 'HOME_NET' redefined Nov 17 13:10:37 nospam snort[32441]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 13:10:37 nospam snort[32441]: , value = any Nov 17 13:10:37 nospam snort[32441]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 13:10:37 nospam snort[32441]: , value = [192.168.1.0/24] Nov 17 13:10:37 nospam snort[32441]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 13:10:37 nospam snort[32441]: , value = [192.168.1.0/24] Nov 17 13:10:37 nospam snort[32441]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 13:10:37 nospam snort[32441]: , value = [192.168.1.0/24] Nov 17 13:10:37 nospam snort[32441]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 13:10:37 nospam snort[32441]: , value = [192.168.1.0/24] Nov 17 13:10:37 nospam snort[32441]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 13:10:37 nospam snort[32441]: , value = [192.168.1.0/24] Nov 17 13:10:37 nospam snort[32441]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 13:10:37 nospam snort[32441]: , value = [192.168.1.0/24] Nov 17 13:10:37 nospam snort[32441]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 13:10:37 nospam snort[32441]: , value = 80 Nov 17 13:10:37 nospam snort[32441]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 13:10:37 nospam snort[32441]: , value = !80 Nov 17 13:10:37 nospam snort[32441]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 13:10:37 nospam snort[32441]: , value = 1521 Nov 17 13:10:37 nospam snort[32441]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 13:10:37 nospam snort[32441]: Nov 17 13:10:37 nospam snort[32441]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 13:10:37 nospam snort[32441]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 13:10:37 nospam snort[32441]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 13:10:37 nospam snort[32441]: , value = /etc/snort/rules Nov 17 13:10:37 nospam snort[32441]: ,-----------[Flow Config]---------------------- Nov 17 13:10:37 nospam snort[32441]: | Stats Interval: 0 Nov 17 13:10:37 nospam snort[32441]: | Hash Method: 2 Nov 17 13:10:37 nospam snort[32441]: | Memcap: 10485760 Nov 17 13:10:37 nospam snort[32441]: | Rows : 4099 Nov 17 13:10:37 nospam snort[32441]: | Overhead Bytes: 32800(%0.31) Nov 17 13:10:37 nospam snort[32441]: `---------------------------------------------- Nov 17 13:10:37 nospam snort[32441]: Frag3 global config: Nov 17 13:10:37 nospam snort[32441]: Max frags: 65536 Nov 17 13:10:37 nospam snort[32441]: Fragment memory cap: 4194304 bytes Nov 17 13:10:37 nospam snort[32441]: Frag3 engine config: Nov 17 13:10:37 nospam snort[32441]: Target-based policy: FIRST Nov 17 13:10:37 nospam snort[32441]: Fragment timeout: 60 seconds Nov 17 13:10:37 nospam snort[32441]: Fragment min_ttl: 1 Nov 17 13:10:37 nospam snort[32441]: Fragment ttl_limit: 5 Nov 17 13:10:37 nospam snort[32441]: Fragment Problems: 1 Nov 17 13:10:37 nospam snort[32441]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 13:10:37 nospam snort[32441]: Stream5 global config: Nov 17 13:10:37 nospam snort[32441]: Track TCP sessions: ACTIVE Nov 17 13:10:37 nospam snort[32441]: Max TCP sessions: 8192 Nov 17 13:10:37 nospam snort[32441]: Memcap (for reassembly packet storage): 8388608 Nov 17 13:10:37 nospam snort[32441]: Track UDP sessions: INACTIVE Nov 17 13:10:37 nospam snort[32441]: Track ICMP sessions: INACTIVE Nov 17 13:10:37 nospam snort[32441]: Stream5 TCP Policy config: Nov 17 13:10:37 nospam snort[32441]: Reassembly Policy: FIRST Nov 17 13:10:37 nospam snort[32441]: Timeout: 30 seconds Nov 17 13:10:37 nospam snort[32441]: Min ttl: 1 Nov 17 13:10:37 nospam snort[32441]: Options: Nov 17 13:10:37 nospam snort[32441]: Static Flushpoint Sizes: YES Nov 17 13:10:37 nospam snort[32441]: Reassembly Ports: Nov 17 13:10:37 nospam snort[32441]: 21 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 23 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 25 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 42 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 53 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 80 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 110 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 111 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 135 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 136 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 137 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 139 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 143 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 445 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 513 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 1433 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 1521 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: 3306 client (Footprint) Nov 17 13:10:37 nospam snort[32441]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 13:10:37 nospam snort[32441]: HttpInspect Config: Nov 17 13:10:37 nospam snort[32441]: GLOBAL CONFIG Nov 17 13:10:37 nospam snort[32441]: Max Pipeline Requests: 0 Nov 17 13:10:37 nospam snort[32441]: Inspection Type: STATELESS Nov 17 13:10:37 nospam snort[32441]: Detect Proxy Usage: NO Nov 17 13:10:37 nospam snort[32441]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 13:10:37 nospam snort[32441]: IIS Unicode Map Codepage: 1252 Nov 17 13:10:37 nospam snort[32441]: DEFAULT SERVER CONFIG: Nov 17 13:10:37 nospam snort[32441]: Server profile: All Nov 17 13:10:37 nospam snort[32441]: Ports: 80 8080 8180 Nov 17 13:10:37 nospam snort[32441]: Flow Depth: 300 Nov 17 13:10:37 nospam snort[32441]: Max Chunk Length: 500000 Nov 17 13:10:37 nospam snort[32441]: Inspect Pipeline Requests: YES Nov 17 13:10:37 nospam snort[32441]: URI Discovery Strict Mode: NO Nov 17 13:10:37 nospam snort[32441]: Allow Proxy Usage: NO Nov 17 13:10:37 nospam snort[32441]: Disable Alerting: NO Nov 17 13:10:37 nospam snort[32441]: Oversize Dir Length: 500 Nov 17 13:10:37 nospam snort[32441]: Only inspect URI: NO Nov 17 13:10:37 nospam snort[32441]: Ascii: YES alert: NO Nov 17 13:10:37 nospam snort[32441]: Double Decoding: YES alert: YES Nov 17 13:10:37 nospam snort[32441]: %U Encoding: YES alert: YES Nov 17 13:10:37 nospam snort[32441]: Bare Byte: YES alert: YES Nov 17 13:10:37 nospam snort[32441]: Base36: OFF Nov 17 13:10:37 nospam snort[32441]: UTF 8: OFF Nov 17 13:10:37 nospam snort[32441]: IIS Unicode: YES alert: YES Nov 17 13:10:37 nospam snort[32441]: Multiple Slash: YES alert: NO Nov 17 13:10:37 nospam snort[32441]: IIS Backslash: YES alert: NO Nov 17 13:10:37 nospam snort[32441]: Directory Traversal: YES alert: NO Nov 17 13:10:37 nospam snort[32441]: Web Root Traversal: YES alert: YES Nov 17 13:10:37 nospam snort[32441]: Apache WhiteSpace: YES alert: NO Nov 17 13:10:37 nospam snort[32441]: IIS Delimiter: YES alert: NO Nov 17 13:10:37 nospam snort[32441]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 13:10:37 nospam snort[32441]: Non-RFC Compliant Characters: NONE Nov 17 13:10:37 nospam snort[32441]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 13:10:37 nospam snort[32441]: rpc_decode arguments: Nov 17 13:10:37 nospam snort[32441]: Ports to decode RPC on: 111 32771 Nov 17 13:10:37 nospam snort[32441]: alert_fragments: INACTIVE Nov 17 13:10:37 nospam snort[32441]: alert_large_fragments: ACTIVE Nov 17 13:10:37 nospam snort[32441]: alert_incomplete: ACTIVE Nov 17 13:10:37 nospam snort[32441]: alert_multiple_requests: ACTIVE Nov 17 13:10:37 nospam snort[32441]: Portscan Detection Config: Nov 17 13:10:37 nospam snort[32441]: Detect Protocols: TCP UDP ICMP IP Nov 17 13:10:37 nospam snort[32441]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 13:10:37 nospam snort[32441]: Sensitivity Level: Low Nov 17 13:10:37 nospam snort[32441]: Memcap (in bytes): 10000000 Nov 17 13:10:37 nospam snort[32441]: Number of Nodes: 26109 Nov 17 13:10:37 nospam snort[32441]: Nov 17 13:10:37 nospam snort[32441]: Tagged Packet Limit: 256 Nov 17 13:10:37 nospam snort[32441]: Nov 17 13:10:37 nospam snort[32441]: +-----------------------[thresholding-config]---------------------------------- Nov 17 13:10:37 nospam snort[32441]: | memory-cap : 1048576 bytes Nov 17 13:10:37 nospam snort[32441]: +-----------------------[thresholding-global]---------------------------------- Nov 17 13:10:37 nospam snort[32441]: | none Nov 17 13:10:37 nospam snort[32441]: +-----------------------[thresholding-local]----------------------------------- Nov 17 13:10:37 nospam snort[32441]: | none Nov 17 13:10:37 nospam snort[32441]: +-----------------------[suppression]------------------------------------------ Nov 17 13:10:37 nospam snort[32441]: | none Nov 17 13:10:37 nospam snort[32441]: ------------------------------------------------------------------------------- Nov 17 13:10:37 nospam snort[32441]: Rule application order: activation->dynamic->pass->drop->alert->log Nov 17 13:10:37 nospam snort[32441]: Log directory = /var/log/snort Nov 17 13:10:37 nospam snort[32441]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Nov 17 13:10:37 nospam snort[32441]: done Nov 17 13:10:37 nospam snort[32441]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Nov 17 13:10:37 nospam snort[32441]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 17 13:10:37 nospam snort[32441]: done Nov 17 13:10:37 nospam snort[32441]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 17 13:10:37 nospam snort[32441]: done Nov 17 13:10:37 nospam snort[32441]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... Nov 17 13:10:37 nospam snort[32441]: done Nov 17 13:10:37 nospam snort[32441]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 17 13:10:37 nospam snort[32441]: done Nov 17 13:10:37 nospam snort[32441]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Nov 17 13:10:37 nospam snort[32441]: done Nov 17 13:10:37 nospam snort[32441]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Nov 17 13:10:37 nospam snort[32441]: FTPTelnet Config: Nov 17 13:10:37 nospam snort[32441]: GLOBAL CONFIG Nov 17 13:10:37 nospam snort[32441]: Inspection Type: stateful Nov 17 13:10:37 nospam snort[32441]: Check for Encrypted Traffic: YES alert: YES Nov 17 13:10:37 nospam snort[32441]: Continue to check encrypted data: NO Nov 17 13:10:37 nospam snort[32441]: TELNET CONFIG: Nov 17 13:10:37 nospam snort[32441]: Ports: 23 Nov 17 13:10:37 nospam snort[32441]: Are You There Threshold: 200 Nov 17 13:10:37 nospam snort[32441]: Normalize: YES Nov 17 13:10:37 nospam snort[32441]: Detect Anomalies: NO Nov 17 13:10:37 nospam snort[32441]: FTP CONFIG: Nov 17 13:10:37 nospam snort[32441]: FTP Server: default Nov 17 13:10:37 nospam snort[32441]: Ports: 21 Nov 17 13:10:37 nospam snort[32441]: Check for Telnet Cmds: YES alert: YES Nov 17 13:10:37 nospam snort[32441]: Identify open data channels: YES Nov 17 13:10:37 nospam snort[32441]: FTP Client: default Nov 17 13:10:37 nospam snort[32441]: Check for Bounce Attacks: YES alert: YES Nov 17 13:10:37 nospam snort[32441]: Check for Telnet Cmds: YES alert: YES Nov 17 13:10:37 nospam snort[32441]: Max Response Length: 256 Nov 17 13:10:37 nospam snort[32441]: SMTP Config: Nov 17 13:10:37 nospam snort[32441]: Ports: Nov 17 13:10:37 nospam snort[32441]: 25 Nov 17 13:10:37 nospam snort[32441]: Nov 17 13:10:37 nospam snort[32441]: Inspection Type: STATEFUL Nov 17 13:10:37 nospam snort[32441]: Normalize Spaces: YES Nov 17 13:10:37 nospam snort[32441]: Ignore Data: NO Nov 17 13:10:37 nospam snort[32441]: Ignore TLS Data: NO Nov 17 13:10:37 nospam snort[32441]: Ignore Alerts: NO Nov 17 13:10:37 nospam snort[32441]: Max Command Length: 0 Nov 17 13:10:37 nospam snort[32441]: Max Header Line Length: 0 Nov 17 13:10:37 nospam snort[32441]: Max Response Line Length: 0 Nov 17 13:10:37 nospam snort[32441]: X-Link2State Alert: YES Nov 17 13:10:37 nospam snort[32441]: Drop on X-Link2State Alert: NO Nov 17 13:10:37 nospam snort[32441]: DCE/RPC Decoder config: Nov 17 13:10:37 nospam snort[32441]: Autodetect ports ENABLED Nov 17 13:10:37 nospam snort[32441]: SMB fragmentation ENABLED Nov 17 13:10:37 nospam snort[32441]: DCE/RPC fragmentation ENABLED Nov 17 13:10:37 nospam snort[32441]: Max Frag Size: 3000 bytes Nov 17 13:10:37 nospam snort[32441]: Memcap: 100000 KB Nov 17 13:10:37 nospam snort[32441]: Alert if memcap exceeded DISABLED Nov 17 13:10:37 nospam snort[32441]: Nov 17 13:10:37 nospam snort[32441]: DNS config: Nov 17 13:10:37 nospam snort[32441]: DNS Client rdata txt Overflow Alert: ACTIVE Nov 17 13:10:37 nospam snort[32441]: Obsolete DNS RR Types Alert: INACTIVE Nov 17 13:10:37 nospam snort[32441]: Experimental DNS RR Types Alert: INACTIVE Nov 17 13:10:37 nospam snort[32441]: Ports: Nov 17 13:10:37 nospam snort[32441]: 53 Nov 17 13:10:37 nospam snort[32441]: Nov 17 13:10:37 nospam snort[32441]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set. Nov 17 13:10:37 nospam snort[32441]: Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked. Nov 17 13:10:37 nospam snort[32441]: Warning: flowbits key 'realplayer.playlist' is checked but not ever set. Nov 17 13:10:37 nospam snort[32441]: Warning: flowbits key 'community_uri.size.1050' is set but not ever checked. Nov 17 13:10:37 nospam snort[32441]: 37 out of 512 flowbits in use. Nov 17 13:10:37 nospam snort[32441]: Initializing daemon mode Nov 17 13:10:37 nospam snort[32447]: PID path stat checked out ok, PID path set to /var/run/ Nov 17 13:10:37 nospam snort[32447]: Writing PID "32447" to file "/var/run//snort_eth0.pid" Nov 17 13:10:37 nospam snort[32447]: Daemon initialized, signaled parent pid: 32441 Nov 17 13:10:37 nospam snort[32441]: Daemon parent exiting Nov 17 13:10:52 nospam snort[32447]: Preprocessor/Decoder Rule Count: 0 Nov 17 13:10:52 nospam snort[32447]: Snort initialization completed successfully (pid=32447) Nov 17 13:10:52 nospam snort[32447]: Not Using PCAP_FRAMES Nov 17 13:10:52 nospam snort[32447]: *** Caught Term-Signal Nov 17 13:10:52 nospam snort[32447]: Frag3 statistics: Nov 17 13:10:52 nospam snort[32447]: Total Fragments: 0 Nov 17 13:10:52 nospam snort[32447]: Frags Reassembled: 0 Nov 17 13:10:52 nospam snort[32447]: Discards: 0 Nov 17 13:10:52 nospam snort[32447]: Memory Faults: 0 Nov 17 13:10:52 nospam snort[32447]: Timeouts: 0 Nov 17 13:10:52 nospam snort[32447]: Overlaps: 0 Nov 17 13:10:52 nospam snort[32447]: Anomalies: 0 Nov 17 13:10:52 nospam snort[32447]: Alerts: 0 Nov 17 13:10:52 nospam snort[32447]: FragTrackers Added: 0 Nov 17 13:10:52 nospam snort[32447]: FragTrackers Dumped: 0 Nov 17 13:10:52 nospam snort[32447]: FragTrackers Auto Freed: 0 Nov 17 13:10:52 nospam snort[32447]: Frag Nodes Inserted: 0 Nov 17 13:10:52 nospam snort[32447]: Frag Nodes Deleted: 0 Nov 17 13:10:52 nospam snort[32447]: =============================================================================== Nov 17 13:10:52 nospam snort[32447]: Stream5 statistics: Nov 17 13:10:52 nospam snort[32447]: Total sessions: 0 Nov 17 13:10:52 nospam snort[32447]: TCP sessions: 0 Nov 17 13:10:52 nospam snort[32447]: UDP sessions: 0 Nov 17 13:10:52 nospam snort[32447]: ICMP sessions: 0 Nov 17 13:10:52 nospam snort[32447]: TCP Prunes: 0 Nov 17 13:10:52 nospam snort[32447]: UDP Prunes: 0 Nov 17 13:10:52 nospam snort[32447]: ICMP Prunes: 0 Nov 17 13:10:52 nospam snort[32447]: TCP StreamTrackers Created: 0 Nov 17 13:10:52 nospam snort[32447]: TCP StreamTrackers Deleted: 0 Nov 17 13:10:52 nospam snort[32447]: TCP Timeouts: 0 Nov 17 13:10:52 nospam snort[32447]: TCP Overlaps: 0 Nov 17 13:10:52 nospam snort[32447]: TCP Segments Queued: 0 Nov 17 13:10:52 nospam snort[32447]: TCP Segments Released: 0 Nov 17 13:10:52 nospam snort[32447]: TCP Rebuilt Packets: 0 Nov 17 13:10:52 nospam snort[32447]: TCP Segments Used: 0 Nov 17 13:10:52 nospam snort[32447]: TCP Discards: 0 Nov 17 13:10:52 nospam snort[32447]: UDP Sessions Created: 0 Nov 17 13:10:52 nospam snort[32447]: UDP Sessions Deleted: 0 Nov 17 13:10:52 nospam snort[32447]: UDP Timeouts: 0 Nov 17 13:10:52 nospam snort[32447]: UDP Discards: 0 Nov 17 13:10:52 nospam snort[32447]: Events: 0 Nov 17 13:10:52 nospam snort[32447]: =============================================================================== Nov 17 13:10:52 nospam snort[32447]: Final Flow Statistics Nov 17 13:10:52 nospam snort[32447]: ,----[ FLOWCACHE STATS ]---------- Nov 17 13:10:52 nospam snort[32447]: Memcap: 10485760 Overhead Bytes 32800 used(%0.312805)/blocks (32800/1) Overhead blocks: 1 Could Hold: (0) Nov 17 13:10:52 nospam snort[32447]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s Nov 17 13:10:52 nospam snort[32447]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0 Nov 17 13:10:52 nospam snort[32447]: Snort received 8381 packets Nov 17 13:10:52 nospam snort[32447]: Analyzed: 0(0.000%) Nov 17 13:10:52 nospam snort[32447]: Dropped: 8110(96.766%) Nov 17 13:10:52 nospam snort[32447]: Outstanding: 271(3.234%) Nov 17 13:10:52 nospam snort[32447]: =============================================================================== Nov 17 13:10:52 nospam snort[32447]: Breakdown by protocol: Nov 17 13:10:52 nospam snort[32447]: TCP: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: UDP: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: ICMP: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: ARP: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: EAPOL: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: IPv6: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: ETHLOOP: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: IPX: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: FRAG: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: OTHER: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: DISCARD: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: InvChkSum: 0 (0.000%) Nov 17 13:10:52 nospam snort[32447]: =============================================================================== Nov 17 13:10:52 nospam snort[32447]: Action Stats: Nov 17 13:10:52 nospam snort[32447]: ALERTS: 0 Nov 17 13:10:52 nospam snort[32447]: LOGGED: 0 Nov 17 13:10:52 nospam snort[32447]: PASSED: 0 Nov 17 13:10:52 nospam snort[32447]: =============================================================================== Nov 17 13:10:54 nospam snort[32447]: Snort exiting Nov 17 13:10:54 nospam snort[32447]: Could not remove pid file /var/run//snort_eth0.pid: Permission denied Nov 17 20:58:23 nospam snort[4257]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 20:58:23 nospam snort[4257]: , value = 66.228.0.0/255.255.252.0 Nov 17 20:58:23 nospam snort[4257]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 20:58:23 nospam snort[4257]: , value = 192.168.1.0/255.255.255.0 Nov 17 20:58:23 nospam snort[4257]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 20:58:23 nospam snort[4257]: , value = 192.168.156.0/255.255.255.0 Nov 17 20:58:23 nospam snort[4257]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 20:58:23 nospam snort[4257]: , value = 192.168.150.0/255.255.255.0 Nov 17 20:58:23 nospam snort[4257]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 20:58:23 nospam snort[4257]: , value = 0.0.0.0/0.0.0.0 Nov 17 20:58:23 nospam snort[4257]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 20:58:23 nospam snort[4257]: , value = 127.0.0.0/255.0.0.0 Nov 17 20:58:23 nospam snort[4257]: Parsing Rules file /etc/snort/snort.conf Nov 17 20:58:23 nospam snort[4257]: Var 'HOME_NET' redefined Nov 17 20:58:23 nospam snort[4257]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 20:58:23 nospam snort[4257]: , value = any Nov 17 20:58:23 nospam snort[4257]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 20:58:23 nospam snort[4257]: , value = [192.168.1.0/24] Nov 17 20:58:23 nospam snort[4257]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 20:58:23 nospam snort[4257]: , value = [192.168.1.0/24] Nov 17 20:58:23 nospam snort[4257]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 20:58:23 nospam snort[4257]: , value = [192.168.1.0/24] Nov 17 20:58:23 nospam snort[4257]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 20:58:23 nospam snort[4257]: , value = [192.168.1.0/24] Nov 17 20:58:23 nospam snort[4257]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 20:58:23 nospam snort[4257]: , value = [192.168.1.0/24] Nov 17 20:58:23 nospam snort[4257]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 20:58:23 nospam snort[4257]: , value = [192.168.1.0/24] Nov 17 20:58:23 nospam snort[4257]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 20:58:23 nospam snort[4257]: , value = 80 Nov 17 20:58:23 nospam snort[4257]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 20:58:23 nospam snort[4257]: , value = !80 Nov 17 20:58:23 nospam snort[4257]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 20:58:23 nospam snort[4257]: , value = 1521 Nov 17 20:58:23 nospam snort[4257]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 20:58:23 nospam snort[4257]: Nov 17 20:58:23 nospam snort[4257]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 20:58:23 nospam snort[4257]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 20:58:23 nospam snort[4257]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 20:58:23 nospam snort[4257]: , value = /etc/snort/rules Nov 17 20:58:23 nospam snort[4257]: ,-----------[Flow Config]---------------------- Nov 17 20:58:23 nospam snort[4257]: | Stats Interval: 0 Nov 17 20:58:23 nospam snort[4257]: | Hash Method: 2 Nov 17 20:58:23 nospam snort[4257]: | Memcap: 10485760 Nov 17 20:58:23 nospam snort[4257]: | Rows : 4099 Nov 17 20:58:23 nospam snort[4257]: | Overhead Bytes: 32800(%0.31) Nov 17 20:58:23 nospam snort[4257]: `---------------------------------------------- Nov 17 20:58:23 nospam snort[4257]: Frag3 global config: Nov 17 20:58:23 nospam snort[4257]: Max frags: 65536 Nov 17 20:58:23 nospam snort[4257]: Fragment memory cap: 4194304 bytes Nov 17 20:58:23 nospam snort[4257]: Frag3 engine config: Nov 17 20:58:23 nospam snort[4257]: Target-based policy: FIRST Nov 17 20:58:23 nospam snort[4257]: Fragment timeout: 60 seconds Nov 17 20:58:23 nospam snort[4257]: Fragment min_ttl: 1 Nov 17 20:58:23 nospam snort[4257]: Fragment ttl_limit: 5 Nov 17 20:58:23 nospam snort[4257]: Fragment Problems: 1 Nov 17 20:58:23 nospam snort[4257]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 20:58:23 nospam snort[4257]: Stream5 global config: Nov 17 20:58:23 nospam snort[4257]: Track TCP sessions: ACTIVE Nov 17 20:58:23 nospam snort[4257]: Max TCP sessions: 8192 Nov 17 20:58:23 nospam snort[4257]: Memcap (for reassembly packet storage): 8388608 Nov 17 20:58:23 nospam snort[4257]: Track UDP sessions: INACTIVE Nov 17 20:58:23 nospam snort[4257]: Track ICMP sessions: INACTIVE Nov 17 20:58:23 nospam snort[4257]: Stream5 TCP Policy config: Nov 17 20:58:23 nospam snort[4257]: Reassembly Policy: FIRST Nov 17 20:58:23 nospam snort[4257]: Timeout: 30 seconds Nov 17 20:58:23 nospam snort[4257]: Min ttl: 1 Nov 17 20:58:23 nospam snort[4257]: Options: Nov 17 20:58:23 nospam snort[4257]: Static Flushpoint Sizes: YES Nov 17 20:58:23 nospam snort[4257]: Reassembly Ports: Nov 17 20:58:23 nospam snort[4257]: 21 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 23 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 25 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 42 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 53 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 80 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 110 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 111 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 135 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 136 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 137 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 139 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 143 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 445 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 513 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 1433 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 1521 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: 3306 client (Footprint) Nov 17 20:58:23 nospam snort[4257]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 20:58:23 nospam snort[4257]: HttpInspect Config: Nov 17 20:58:23 nospam snort[4257]: GLOBAL CONFIG Nov 17 20:58:23 nospam snort[4257]: Max Pipeline Requests: 0 Nov 17 20:58:23 nospam snort[4257]: Inspection Type: STATELESS Nov 17 20:58:23 nospam snort[4257]: Detect Proxy Usage: NO Nov 17 20:58:23 nospam snort[4257]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 20:58:23 nospam snort[4257]: IIS Unicode Map Codepage: 1252 Nov 17 20:58:23 nospam snort[4257]: DEFAULT SERVER CONFIG: Nov 17 20:58:23 nospam snort[4257]: Server profile: All Nov 17 20:58:23 nospam snort[4257]: Ports: 80 8080 8180 Nov 17 20:58:23 nospam snort[4257]: Flow Depth: 300 Nov 17 20:58:23 nospam snort[4257]: Max Chunk Length: 500000 Nov 17 20:58:23 nospam snort[4257]: Inspect Pipeline Requests: YES Nov 17 20:58:23 nospam snort[4257]: URI Discovery Strict Mode: NO Nov 17 20:58:23 nospam snort[4257]: Allow Proxy Usage: NO Nov 17 20:58:23 nospam snort[4257]: Disable Alerting: NO Nov 17 20:58:23 nospam snort[4257]: Oversize Dir Length: 500 Nov 17 20:58:23 nospam snort[4257]: Only inspect URI: NO Nov 17 20:58:23 nospam snort[4257]: Ascii: YES alert: NO Nov 17 20:58:23 nospam snort[4257]: Double Decoding: YES alert: YES Nov 17 20:58:23 nospam snort[4257]: %U Encoding: YES alert: YES Nov 17 20:58:23 nospam snort[4257]: Bare Byte: YES alert: YES Nov 17 20:58:23 nospam snort[4257]: Base36: OFF Nov 17 20:58:23 nospam snort[4257]: UTF 8: OFF Nov 17 20:58:23 nospam snort[4257]: IIS Unicode: YES alert: YES Nov 17 20:58:23 nospam snort[4257]: Multiple Slash: YES alert: NO Nov 17 20:58:23 nospam snort[4257]: IIS Backslash: YES alert: NO Nov 17 20:58:23 nospam snort[4257]: Directory Traversal: YES alert: NO Nov 17 20:58:23 nospam snort[4257]: Web Root Traversal: YES alert: YES Nov 17 20:58:23 nospam snort[4257]: Apache WhiteSpace: YES alert: NO Nov 17 20:58:23 nospam snort[4257]: IIS Delimiter: YES alert: NO Nov 17 20:58:23 nospam snort[4257]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 20:58:23 nospam snort[4257]: Non-RFC Compliant Characters: NONE Nov 17 20:58:23 nospam snort[4257]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 20:58:23 nospam snort[4257]: rpc_decode arguments: Nov 17 20:58:23 nospam snort[4257]: Ports to decode RPC on: 111 32771 Nov 17 20:58:23 nospam snort[4257]: alert_fragments: INACTIVE Nov 17 20:58:23 nospam snort[4257]: alert_large_fragments: ACTIVE Nov 17 20:58:23 nospam snort[4257]: alert_incomplete: ACTIVE Nov 17 20:58:23 nospam snort[4257]: alert_multiple_requests: ACTIVE Nov 17 20:58:23 nospam snort[4257]: Portscan Detection Config: Nov 17 20:58:23 nospam snort[4257]: Detect Protocols: TCP UDP ICMP IP Nov 17 20:58:23 nospam snort[4257]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 20:58:23 nospam snort[4257]: Sensitivity Level: Low Nov 17 20:58:23 nospam snort[4257]: Memcap (in bytes): 10000000 Nov 17 20:58:23 nospam snort[4257]: Number of Nodes: 26109 Nov 17 20:58:23 nospam snort[4257]: Nov 17 20:58:23 nospam snort[4257]: FATAL ERROR: Unable to open rules file: /etc/snort/rules/community-inappropiate.rules or /etc/snort//etc/snort/rules/community-inappropiate.rules Nov 17 20:58:48 nospam snort[4320]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 20:58:48 nospam snort[4320]: , value = 66.228.0.0/255.255.252.0 Nov 17 20:58:48 nospam snort[4320]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 20:58:48 nospam snort[4320]: , value = 192.168.1.0/255.255.255.0 Nov 17 20:58:48 nospam snort[4320]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 20:58:48 nospam snort[4320]: , value = 192.168.156.0/255.255.255.0 Nov 17 20:58:48 nospam snort[4320]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 20:58:48 nospam snort[4320]: , value = 192.168.150.0/255.255.255.0 Nov 17 20:58:48 nospam snort[4320]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 20:58:48 nospam snort[4320]: , value = 0.0.0.0/0.0.0.0 Nov 17 20:58:48 nospam snort[4320]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 20:58:48 nospam snort[4320]: , value = 127.0.0.0/255.0.0.0 Nov 17 20:58:48 nospam snort[4320]: Parsing Rules file /etc/snort/snort.conf Nov 17 20:58:48 nospam snort[4320]: Var 'HOME_NET' redefined Nov 17 20:58:48 nospam snort[4320]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 20:58:48 nospam snort[4320]: , value = any Nov 17 20:58:48 nospam snort[4320]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 20:58:48 nospam snort[4320]: , value = [192.168.1.0/24] Nov 17 20:58:48 nospam snort[4320]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 20:58:48 nospam snort[4320]: , value = [192.168.1.0/24] Nov 17 20:58:48 nospam snort[4320]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 20:58:48 nospam snort[4320]: , value = [192.168.1.0/24] Nov 17 20:58:48 nospam snort[4320]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 20:58:48 nospam snort[4320]: , value = [192.168.1.0/24] Nov 17 20:58:48 nospam snort[4320]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 20:58:48 nospam snort[4320]: , value = [192.168.1.0/24] Nov 17 20:58:48 nospam snort[4320]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 20:58:48 nospam snort[4320]: , value = [192.168.1.0/24] Nov 17 20:58:48 nospam snort[4320]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 20:58:48 nospam snort[4320]: , value = 80 Nov 17 20:58:48 nospam snort[4320]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 20:58:48 nospam snort[4320]: , value = !80 Nov 17 20:58:48 nospam snort[4320]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 20:58:48 nospam snort[4320]: , value = 1521 Nov 17 20:58:48 nospam snort[4320]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 20:58:48 nospam snort[4320]: Nov 17 20:58:48 nospam snort[4320]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 20:58:48 nospam snort[4320]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 20:58:48 nospam snort[4320]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 20:58:48 nospam snort[4320]: , value = /etc/snort/rules Nov 17 20:58:48 nospam snort[4320]: ,-----------[Flow Config]---------------------- Nov 17 20:58:48 nospam snort[4320]: | Stats Interval: 0 Nov 17 20:58:48 nospam snort[4320]: | Hash Method: 2 Nov 17 20:58:48 nospam snort[4320]: | Memcap: 10485760 Nov 17 20:58:48 nospam snort[4320]: | Rows : 4099 Nov 17 20:58:48 nospam snort[4320]: | Overhead Bytes: 32800(%0.31) Nov 17 20:58:48 nospam snort[4320]: `---------------------------------------------- Nov 17 20:58:48 nospam snort[4320]: Frag3 global config: Nov 17 20:58:48 nospam snort[4320]: Max frags: 65536 Nov 17 20:58:48 nospam snort[4320]: Fragment memory cap: 4194304 bytes Nov 17 20:58:48 nospam snort[4320]: Frag3 engine config: Nov 17 20:58:48 nospam snort[4320]: Target-based policy: FIRST Nov 17 20:58:48 nospam snort[4320]: Fragment timeout: 60 seconds Nov 17 20:58:48 nospam snort[4320]: Fragment min_ttl: 1 Nov 17 20:58:48 nospam snort[4320]: Fragment ttl_limit: 5 Nov 17 20:58:48 nospam snort[4320]: Fragment Problems: 1 Nov 17 20:58:48 nospam snort[4320]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 20:58:48 nospam snort[4320]: Stream5 global config: Nov 17 20:58:48 nospam snort[4320]: Track TCP sessions: ACTIVE Nov 17 20:58:48 nospam snort[4320]: Max TCP sessions: 8192 Nov 17 20:58:48 nospam snort[4320]: Memcap (for reassembly packet storage): 8388608 Nov 17 20:58:48 nospam snort[4320]: Track UDP sessions: INACTIVE Nov 17 20:58:48 nospam snort[4320]: Track ICMP sessions: INACTIVE Nov 17 20:58:48 nospam snort[4320]: Stream5 TCP Policy config: Nov 17 20:58:48 nospam snort[4320]: Reassembly Policy: FIRST Nov 17 20:58:48 nospam snort[4320]: Timeout: 30 seconds Nov 17 20:58:48 nospam snort[4320]: Min ttl: 1 Nov 17 20:58:48 nospam snort[4320]: Options: Nov 17 20:58:48 nospam snort[4320]: Static Flushpoint Sizes: YES Nov 17 20:58:48 nospam snort[4320]: Reassembly Ports: Nov 17 20:58:48 nospam snort[4320]: 21 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 23 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 25 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 42 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 53 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 80 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 110 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 111 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 135 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 136 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 137 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 139 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 143 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 445 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 513 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 1433 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 1521 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: 3306 client (Footprint) Nov 17 20:58:48 nospam snort[4320]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 20:58:48 nospam snort[4320]: HttpInspect Config: Nov 17 20:58:48 nospam snort[4320]: GLOBAL CONFIG Nov 17 20:58:48 nospam snort[4320]: Max Pipeline Requests: 0 Nov 17 20:58:48 nospam snort[4320]: Inspection Type: STATELESS Nov 17 20:58:48 nospam snort[4320]: Detect Proxy Usage: NO Nov 17 20:58:48 nospam snort[4320]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 20:58:48 nospam snort[4320]: IIS Unicode Map Codepage: 1252 Nov 17 20:58:48 nospam snort[4320]: DEFAULT SERVER CONFIG: Nov 17 20:58:48 nospam snort[4320]: Server profile: All Nov 17 20:58:48 nospam snort[4320]: Ports: 80 8080 8180 Nov 17 20:58:48 nospam snort[4320]: Flow Depth: 300 Nov 17 20:58:48 nospam snort[4320]: Max Chunk Length: 500000 Nov 17 20:58:48 nospam snort[4320]: Inspect Pipeline Requests: YES Nov 17 20:58:48 nospam snort[4320]: URI Discovery Strict Mode: NO Nov 17 20:58:48 nospam snort[4320]: Allow Proxy Usage: NO Nov 17 20:58:48 nospam snort[4320]: Disable Alerting: NO Nov 17 20:58:48 nospam snort[4320]: Oversize Dir Length: 500 Nov 17 20:58:48 nospam snort[4320]: Only inspect URI: NO Nov 17 20:58:48 nospam snort[4320]: Ascii: YES alert: NO Nov 17 20:58:48 nospam snort[4320]: Double Decoding: YES alert: YES Nov 17 20:58:48 nospam snort[4320]: %U Encoding: YES alert: YES Nov 17 20:58:48 nospam snort[4320]: Bare Byte: YES alert: YES Nov 17 20:58:48 nospam snort[4320]: Base36: OFF Nov 17 20:58:48 nospam snort[4320]: UTF 8: OFF Nov 17 20:58:48 nospam snort[4320]: IIS Unicode: YES alert: YES Nov 17 20:58:48 nospam snort[4320]: Multiple Slash: YES alert: NO Nov 17 20:58:48 nospam snort[4320]: IIS Backslash: YES alert: NO Nov 17 20:58:48 nospam snort[4320]: Directory Traversal: YES alert: NO Nov 17 20:58:48 nospam snort[4320]: Web Root Traversal: YES alert: YES Nov 17 20:58:48 nospam snort[4320]: Apache WhiteSpace: YES alert: NO Nov 17 20:58:48 nospam snort[4320]: IIS Delimiter: YES alert: NO Nov 17 20:58:48 nospam snort[4320]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 20:58:48 nospam snort[4320]: Non-RFC Compliant Characters: NONE Nov 17 20:58:48 nospam snort[4320]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 20:58:48 nospam snort[4320]: rpc_decode arguments: Nov 17 20:58:48 nospam snort[4320]: Ports to decode RPC on: 111 32771 Nov 17 20:58:48 nospam snort[4320]: alert_fragments: INACTIVE Nov 17 20:58:48 nospam snort[4320]: alert_large_fragments: ACTIVE Nov 17 20:58:48 nospam snort[4320]: alert_incomplete: ACTIVE Nov 17 20:58:48 nospam snort[4320]: alert_multiple_requests: ACTIVE Nov 17 20:58:48 nospam snort[4320]: Portscan Detection Config: Nov 17 20:58:48 nospam snort[4320]: Detect Protocols: TCP UDP ICMP IP Nov 17 20:58:48 nospam snort[4320]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 20:58:48 nospam snort[4320]: Sensitivity Level: Low Nov 17 20:58:48 nospam snort[4320]: Memcap (in bytes): 10000000 Nov 17 20:58:48 nospam snort[4320]: Number of Nodes: 26109 Nov 17 20:58:48 nospam snort[4320]: Nov 17 20:58:48 nospam snort[4320]: FATAL ERROR: Unable to open rules file: /etc/snort/rules/community-inappropiate.rules or /etc/snort//etc/snort/rules/community-inappropiate.rules Nov 17 21:00:38 nospam snort[4473]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:00:38 nospam snort[4473]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:00:38 nospam snort[4473]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:00:38 nospam snort[4473]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:00:38 nospam snort[4473]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:00:38 nospam snort[4473]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:00:38 nospam snort[4473]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:00:38 nospam snort[4473]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:00:38 nospam snort[4473]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:00:38 nospam snort[4473]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:00:38 nospam snort[4473]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:00:38 nospam snort[4473]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:00:38 nospam snort[4473]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:00:38 nospam snort[4473]: Var 'HOME_NET' redefined Nov 17 21:00:38 nospam snort[4473]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:00:38 nospam snort[4473]: , value = any Nov 17 21:00:38 nospam snort[4473]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:00:38 nospam snort[4473]: , value = [192.168.1.0/24] Nov 17 21:00:38 nospam snort[4473]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:00:38 nospam snort[4473]: , value = [192.168.1.0/24] Nov 17 21:00:38 nospam snort[4473]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:00:38 nospam snort[4473]: , value = [192.168.1.0/24] Nov 17 21:00:38 nospam snort[4473]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:00:38 nospam snort[4473]: , value = [192.168.1.0/24] Nov 17 21:00:38 nospam snort[4473]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:00:38 nospam snort[4473]: , value = [192.168.1.0/24] Nov 17 21:00:38 nospam snort[4473]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:00:38 nospam snort[4473]: , value = [192.168.1.0/24] Nov 17 21:00:38 nospam snort[4473]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:00:38 nospam snort[4473]: , value = 80 Nov 17 21:00:38 nospam snort[4473]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:00:38 nospam snort[4473]: , value = !80 Nov 17 21:00:38 nospam snort[4473]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:00:38 nospam snort[4473]: , value = 1521 Nov 17 21:00:38 nospam snort[4473]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:00:38 nospam snort[4473]: Nov 17 21:00:38 nospam snort[4473]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:00:38 nospam snort[4473]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:00:38 nospam snort[4473]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:00:38 nospam snort[4473]: , value = /etc/snort/rules Nov 17 21:00:38 nospam snort[4473]: ,-----------[Flow Config]---------------------- Nov 17 21:00:38 nospam snort[4473]: | Stats Interval: 0 Nov 17 21:00:38 nospam snort[4473]: | Hash Method: 2 Nov 17 21:00:38 nospam snort[4473]: | Memcap: 10485760 Nov 17 21:00:38 nospam snort[4473]: | Rows : 4099 Nov 17 21:00:38 nospam snort[4473]: | Overhead Bytes: 32800(%0.31) Nov 17 21:00:38 nospam snort[4473]: `---------------------------------------------- Nov 17 21:00:38 nospam snort[4473]: Frag3 global config: Nov 17 21:00:38 nospam snort[4473]: Max frags: 65536 Nov 17 21:00:38 nospam snort[4473]: Fragment memory cap: 4194304 bytes Nov 17 21:00:38 nospam snort[4473]: Frag3 engine config: Nov 17 21:00:38 nospam snort[4473]: Target-based policy: FIRST Nov 17 21:00:38 nospam snort[4473]: Fragment timeout: 60 seconds Nov 17 21:00:38 nospam snort[4473]: Fragment min_ttl: 1 Nov 17 21:00:38 nospam snort[4473]: Fragment ttl_limit: 5 Nov 17 21:00:38 nospam snort[4473]: Fragment Problems: 1 Nov 17 21:00:38 nospam snort[4473]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:00:38 nospam snort[4473]: Stream5 global config: Nov 17 21:00:38 nospam snort[4473]: Track TCP sessions: ACTIVE Nov 17 21:00:38 nospam snort[4473]: Max TCP sessions: 8192 Nov 17 21:00:38 nospam snort[4473]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:00:38 nospam snort[4473]: Track UDP sessions: INACTIVE Nov 17 21:00:38 nospam snort[4473]: Track ICMP sessions: INACTIVE Nov 17 21:00:38 nospam snort[4473]: Stream5 TCP Policy config: Nov 17 21:00:38 nospam snort[4473]: Reassembly Policy: FIRST Nov 17 21:00:38 nospam snort[4473]: Timeout: 30 seconds Nov 17 21:00:38 nospam snort[4473]: Min ttl: 1 Nov 17 21:00:38 nospam snort[4473]: Options: Nov 17 21:00:38 nospam snort[4473]: Static Flushpoint Sizes: YES Nov 17 21:00:38 nospam snort[4473]: Reassembly Ports: Nov 17 21:00:38 nospam snort[4473]: 21 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 23 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 25 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 42 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 53 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 80 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 110 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 111 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 135 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 136 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 137 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 139 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 143 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 445 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 513 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 1433 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 1521 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: 3306 client (Footprint) Nov 17 21:00:38 nospam snort[4473]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:00:38 nospam snort[4473]: HttpInspect Config: Nov 17 21:00:38 nospam snort[4473]: GLOBAL CONFIG Nov 17 21:00:38 nospam snort[4473]: Max Pipeline Requests: 0 Nov 17 21:00:38 nospam snort[4473]: Inspection Type: STATELESS Nov 17 21:00:38 nospam snort[4473]: Detect Proxy Usage: NO Nov 17 21:00:38 nospam snort[4473]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:00:38 nospam snort[4473]: IIS Unicode Map Codepage: 1252 Nov 17 21:00:38 nospam snort[4473]: DEFAULT SERVER CONFIG: Nov 17 21:00:38 nospam snort[4473]: Server profile: All Nov 17 21:00:38 nospam snort[4473]: Ports: 80 8080 8180 Nov 17 21:00:38 nospam snort[4473]: Flow Depth: 300 Nov 17 21:00:38 nospam snort[4473]: Max Chunk Length: 500000 Nov 17 21:00:38 nospam snort[4473]: Inspect Pipeline Requests: YES Nov 17 21:00:38 nospam snort[4473]: URI Discovery Strict Mode: NO Nov 17 21:00:38 nospam snort[4473]: Allow Proxy Usage: NO Nov 17 21:00:38 nospam snort[4473]: Disable Alerting: NO Nov 17 21:00:38 nospam snort[4473]: Oversize Dir Length: 500 Nov 17 21:00:38 nospam snort[4473]: Only inspect URI: NO Nov 17 21:00:38 nospam snort[4473]: Ascii: YES alert: NO Nov 17 21:00:38 nospam snort[4473]: Double Decoding: YES alert: YES Nov 17 21:00:38 nospam snort[4473]: %U Encoding: YES alert: YES Nov 17 21:00:38 nospam snort[4473]: Bare Byte: YES alert: YES Nov 17 21:00:38 nospam snort[4473]: Base36: OFF Nov 17 21:00:38 nospam snort[4473]: UTF 8: OFF Nov 17 21:00:38 nospam snort[4473]: IIS Unicode: YES alert: YES Nov 17 21:00:38 nospam snort[4473]: Multiple Slash: YES alert: NO Nov 17 21:00:38 nospam snort[4473]: IIS Backslash: YES alert: NO Nov 17 21:00:38 nospam snort[4473]: Directory Traversal: YES alert: NO Nov 17 21:00:38 nospam snort[4473]: Web Root Traversal: YES alert: YES Nov 17 21:00:38 nospam snort[4473]: Apache WhiteSpace: YES alert: NO Nov 17 21:00:38 nospam snort[4473]: IIS Delimiter: YES alert: NO Nov 17 21:00:38 nospam snort[4473]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:00:38 nospam snort[4473]: Non-RFC Compliant Characters: NONE Nov 17 21:00:38 nospam snort[4473]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:00:38 nospam snort[4473]: rpc_decode arguments: Nov 17 21:00:38 nospam snort[4473]: Ports to decode RPC on: 111 32771 Nov 17 21:00:38 nospam snort[4473]: alert_fragments: INACTIVE Nov 17 21:00:38 nospam snort[4473]: alert_large_fragments: ACTIVE Nov 17 21:00:38 nospam snort[4473]: alert_incomplete: ACTIVE Nov 17 21:00:38 nospam snort[4473]: alert_multiple_requests: ACTIVE Nov 17 21:00:38 nospam snort[4473]: Portscan Detection Config: Nov 17 21:00:38 nospam snort[4473]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:00:38 nospam snort[4473]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:00:38 nospam snort[4473]: Sensitivity Level: Low Nov 17 21:00:38 nospam snort[4473]: Memcap (in bytes): 10000000 Nov 17 21:00:38 nospam snort[4473]: Number of Nodes: 26109 Nov 17 21:00:38 nospam snort[4473]: Nov 17 21:00:38 nospam snort[4473]: FATAL ERROR: Unable to open rules file: /etc/snort/rules/community-inappropiate.rules or /etc/snort//etc/snort/rules/community-inappropiate.rules Nov 17 21:02:00 nospam snort[4553]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:02:00 nospam snort[4553]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:02:00 nospam snort[4553]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:02:00 nospam snort[4553]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:02:00 nospam snort[4553]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:02:00 nospam snort[4553]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:02:00 nospam snort[4553]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:02:00 nospam snort[4553]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:02:00 nospam snort[4553]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:02:00 nospam snort[4553]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:02:00 nospam snort[4553]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:02:00 nospam snort[4553]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:02:00 nospam snort[4553]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:02:00 nospam snort[4553]: Var 'HOME_NET' redefined Nov 17 21:02:00 nospam snort[4553]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:02:00 nospam snort[4553]: , value = any Nov 17 21:02:00 nospam snort[4553]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:02:00 nospam snort[4553]: , value = [192.168.1.0/24] Nov 17 21:02:00 nospam snort[4553]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:02:00 nospam snort[4553]: , value = [192.168.1.0/24] Nov 17 21:02:00 nospam snort[4553]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:02:00 nospam snort[4553]: , value = [192.168.1.0/24] Nov 17 21:02:00 nospam snort[4553]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:02:00 nospam snort[4553]: , value = [192.168.1.0/24] Nov 17 21:02:00 nospam snort[4553]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:02:00 nospam snort[4553]: , value = [192.168.1.0/24] Nov 17 21:02:00 nospam snort[4553]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:02:00 nospam snort[4553]: , value = [192.168.1.0/24] Nov 17 21:02:00 nospam snort[4553]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:02:00 nospam snort[4553]: , value = 80 Nov 17 21:02:00 nospam snort[4553]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:02:00 nospam snort[4553]: , value = !80 Nov 17 21:02:00 nospam snort[4553]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:02:00 nospam snort[4553]: , value = 1521 Nov 17 21:02:00 nospam snort[4553]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:02:00 nospam snort[4553]: Nov 17 21:02:00 nospam snort[4553]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:02:00 nospam snort[4553]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:02:00 nospam snort[4553]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:02:00 nospam snort[4553]: , value = /etc/snort/rules Nov 17 21:02:00 nospam snort[4553]: ,-----------[Flow Config]---------------------- Nov 17 21:02:00 nospam snort[4553]: | Stats Interval: 0 Nov 17 21:02:00 nospam snort[4553]: | Hash Method: 2 Nov 17 21:02:00 nospam snort[4553]: | Memcap: 10485760 Nov 17 21:02:00 nospam snort[4553]: | Rows : 4099 Nov 17 21:02:00 nospam snort[4553]: | Overhead Bytes: 32800(%0.31) Nov 17 21:02:00 nospam snort[4553]: `---------------------------------------------- Nov 17 21:02:00 nospam snort[4553]: Frag3 global config: Nov 17 21:02:00 nospam snort[4553]: Max frags: 65536 Nov 17 21:02:00 nospam snort[4553]: Fragment memory cap: 4194304 bytes Nov 17 21:02:00 nospam snort[4553]: Frag3 engine config: Nov 17 21:02:00 nospam snort[4553]: Target-based policy: FIRST Nov 17 21:02:00 nospam snort[4553]: Fragment timeout: 60 seconds Nov 17 21:02:00 nospam snort[4553]: Fragment min_ttl: 1 Nov 17 21:02:00 nospam snort[4553]: Fragment ttl_limit: 5 Nov 17 21:02:00 nospam snort[4553]: Fragment Problems: 1 Nov 17 21:02:00 nospam snort[4553]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:02:00 nospam snort[4553]: Stream5 global config: Nov 17 21:02:00 nospam snort[4553]: Track TCP sessions: ACTIVE Nov 17 21:02:00 nospam snort[4553]: Max TCP sessions: 8192 Nov 17 21:02:00 nospam snort[4553]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:02:00 nospam snort[4553]: Track UDP sessions: INACTIVE Nov 17 21:02:00 nospam snort[4553]: Track ICMP sessions: INACTIVE Nov 17 21:02:00 nospam snort[4553]: Stream5 TCP Policy config: Nov 17 21:02:00 nospam snort[4553]: Reassembly Policy: FIRST Nov 17 21:02:00 nospam snort[4553]: Timeout: 30 seconds Nov 17 21:02:00 nospam snort[4553]: Min ttl: 1 Nov 17 21:02:00 nospam snort[4553]: Options: Nov 17 21:02:00 nospam snort[4553]: Static Flushpoint Sizes: YES Nov 17 21:02:00 nospam snort[4553]: Reassembly Ports: Nov 17 21:02:00 nospam snort[4553]: 21 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 23 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 25 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 42 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 53 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 80 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 110 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 111 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 135 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 136 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 137 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 139 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 143 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 445 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 513 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 1433 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 1521 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: 3306 client (Footprint) Nov 17 21:02:00 nospam snort[4553]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:02:00 nospam snort[4553]: HttpInspect Config: Nov 17 21:02:00 nospam snort[4553]: GLOBAL CONFIG Nov 17 21:02:00 nospam snort[4553]: Max Pipeline Requests: 0 Nov 17 21:02:00 nospam snort[4553]: Inspection Type: STATELESS Nov 17 21:02:00 nospam snort[4553]: Detect Proxy Usage: NO Nov 17 21:02:00 nospam snort[4553]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:02:00 nospam snort[4553]: IIS Unicode Map Codepage: 1252 Nov 17 21:02:00 nospam snort[4553]: DEFAULT SERVER CONFIG: Nov 17 21:02:00 nospam snort[4553]: Server profile: All Nov 17 21:02:00 nospam snort[4553]: Ports: 80 8080 8180 Nov 17 21:02:00 nospam snort[4553]: Flow Depth: 300 Nov 17 21:02:00 nospam snort[4553]: Max Chunk Length: 500000 Nov 17 21:02:00 nospam snort[4553]: Inspect Pipeline Requests: YES Nov 17 21:02:00 nospam snort[4553]: URI Discovery Strict Mode: NO Nov 17 21:02:00 nospam snort[4553]: Allow Proxy Usage: NO Nov 17 21:02:00 nospam snort[4553]: Disable Alerting: NO Nov 17 21:02:00 nospam snort[4553]: Oversize Dir Length: 500 Nov 17 21:02:00 nospam snort[4553]: Only inspect URI: NO Nov 17 21:02:00 nospam snort[4553]: Ascii: YES alert: NO Nov 17 21:02:00 nospam snort[4553]: Double Decoding: YES alert: YES Nov 17 21:02:00 nospam snort[4553]: %U Encoding: YES alert: YES Nov 17 21:02:00 nospam snort[4553]: Bare Byte: YES alert: YES Nov 17 21:02:00 nospam snort[4553]: Base36: OFF Nov 17 21:02:00 nospam snort[4553]: UTF 8: OFF Nov 17 21:02:00 nospam snort[4553]: IIS Unicode: YES alert: YES Nov 17 21:02:00 nospam snort[4553]: Multiple Slash: YES alert: NO Nov 17 21:02:00 nospam snort[4553]: IIS Backslash: YES alert: NO Nov 17 21:02:00 nospam snort[4553]: Directory Traversal: YES alert: NO Nov 17 21:02:00 nospam snort[4553]: Web Root Traversal: YES alert: YES Nov 17 21:02:00 nospam snort[4553]: Apache WhiteSpace: YES alert: NO Nov 17 21:02:00 nospam snort[4553]: IIS Delimiter: YES alert: NO Nov 17 21:02:00 nospam snort[4553]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:02:00 nospam snort[4553]: Non-RFC Compliant Characters: NONE Nov 17 21:02:00 nospam snort[4553]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:02:00 nospam snort[4553]: rpc_decode arguments: Nov 17 21:02:00 nospam snort[4553]: Ports to decode RPC on: 111 32771 Nov 17 21:02:00 nospam snort[4553]: alert_fragments: INACTIVE Nov 17 21:02:00 nospam snort[4553]: alert_large_fragments: ACTIVE Nov 17 21:02:00 nospam snort[4553]: alert_incomplete: ACTIVE Nov 17 21:02:00 nospam snort[4553]: alert_multiple_requests: ACTIVE Nov 17 21:02:00 nospam snort[4553]: Portscan Detection Config: Nov 17 21:02:00 nospam snort[4553]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:02:00 nospam snort[4553]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:02:00 nospam snort[4553]: Sensitivity Level: Low Nov 17 21:02:00 nospam snort[4553]: Memcap (in bytes): 10000000 Nov 17 21:02:00 nospam snort[4553]: Number of Nodes: 26109 Nov 17 21:02:00 nospam snort[4553]: Nov 17 21:02:00 nospam snort[4553]: FATAL ERROR: Unable to open rules file: /etc/snort/rules/community-inappropiate.rules or /etc/snort//etc/snort/rules/community-inappropiate.rules Nov 17 21:03:54 nospam snort[4697]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:03:54 nospam snort[4697]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:03:54 nospam snort[4697]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:03:54 nospam snort[4697]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:03:54 nospam snort[4697]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:03:54 nospam snort[4697]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:03:54 nospam snort[4697]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:03:54 nospam snort[4697]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:03:54 nospam snort[4697]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:03:54 nospam snort[4697]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:03:54 nospam snort[4697]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:03:54 nospam snort[4697]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:03:54 nospam snort[4697]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:03:54 nospam snort[4697]: Var 'HOME_NET' redefined Nov 17 21:03:54 nospam snort[4697]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:03:54 nospam snort[4697]: , value = any Nov 17 21:03:54 nospam snort[4697]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:03:54 nospam snort[4697]: , value = [192.168.1.0/24] Nov 17 21:03:54 nospam snort[4697]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:03:54 nospam snort[4697]: , value = [192.168.1.0/24] Nov 17 21:03:54 nospam snort[4697]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:03:54 nospam snort[4697]: , value = [192.168.1.0/24] Nov 17 21:03:54 nospam snort[4697]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:03:54 nospam snort[4697]: , value = [192.168.1.0/24] Nov 17 21:03:54 nospam snort[4697]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:03:54 nospam snort[4697]: , value = [192.168.1.0/24] Nov 17 21:03:54 nospam snort[4697]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:03:54 nospam snort[4697]: , value = [192.168.1.0/24] Nov 17 21:03:54 nospam snort[4697]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:03:54 nospam snort[4697]: , value = 80 Nov 17 21:03:54 nospam snort[4697]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:03:54 nospam snort[4697]: , value = !80 Nov 17 21:03:54 nospam snort[4697]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:03:54 nospam snort[4697]: , value = 1521 Nov 17 21:03:54 nospam snort[4697]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:03:54 nospam snort[4697]: Nov 17 21:03:54 nospam snort[4697]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:03:54 nospam snort[4697]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:03:54 nospam snort[4697]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:03:54 nospam snort[4697]: , value = /etc/snort/rules Nov 17 21:03:54 nospam snort[4697]: ,-----------[Flow Config]---------------------- Nov 17 21:03:54 nospam snort[4697]: | Stats Interval: 0 Nov 17 21:03:54 nospam snort[4697]: | Hash Method: 2 Nov 17 21:03:54 nospam snort[4697]: | Memcap: 10485760 Nov 17 21:03:54 nospam snort[4697]: | Rows : 4099 Nov 17 21:03:54 nospam snort[4697]: | Overhead Bytes: 32800(%0.31) Nov 17 21:03:54 nospam snort[4697]: `---------------------------------------------- Nov 17 21:03:54 nospam snort[4697]: Frag3 global config: Nov 17 21:03:54 nospam snort[4697]: Max frags: 65536 Nov 17 21:03:54 nospam snort[4697]: Fragment memory cap: 4194304 bytes Nov 17 21:03:54 nospam snort[4697]: Frag3 engine config: Nov 17 21:03:54 nospam snort[4697]: Target-based policy: FIRST Nov 17 21:03:54 nospam snort[4697]: Fragment timeout: 60 seconds Nov 17 21:03:54 nospam snort[4697]: Fragment min_ttl: 1 Nov 17 21:03:54 nospam snort[4697]: Fragment ttl_limit: 5 Nov 17 21:03:54 nospam snort[4697]: Fragment Problems: 1 Nov 17 21:03:54 nospam snort[4697]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:03:54 nospam snort[4697]: Stream5 global config: Nov 17 21:03:54 nospam snort[4697]: Track TCP sessions: ACTIVE Nov 17 21:03:54 nospam snort[4697]: Max TCP sessions: 8192 Nov 17 21:03:54 nospam snort[4697]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:03:54 nospam snort[4697]: Track UDP sessions: INACTIVE Nov 17 21:03:54 nospam snort[4697]: Track ICMP sessions: INACTIVE Nov 17 21:03:54 nospam snort[4697]: Stream5 TCP Policy config: Nov 17 21:03:54 nospam snort[4697]: Reassembly Policy: FIRST Nov 17 21:03:54 nospam snort[4697]: Timeout: 30 seconds Nov 17 21:03:54 nospam snort[4697]: Min ttl: 1 Nov 17 21:03:54 nospam snort[4697]: Options: Nov 17 21:03:54 nospam snort[4697]: Static Flushpoint Sizes: YES Nov 17 21:03:54 nospam snort[4697]: Reassembly Ports: Nov 17 21:03:54 nospam snort[4697]: 21 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 23 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 25 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 42 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 53 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 80 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 110 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 111 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 135 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 136 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 137 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 139 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 143 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 445 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 513 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 1433 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 1521 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: 3306 client (Footprint) Nov 17 21:03:54 nospam snort[4697]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:03:54 nospam snort[4697]: HttpInspect Config: Nov 17 21:03:54 nospam snort[4697]: GLOBAL CONFIG Nov 17 21:03:54 nospam snort[4697]: Max Pipeline Requests: 0 Nov 17 21:03:54 nospam snort[4697]: Inspection Type: STATELESS Nov 17 21:03:54 nospam snort[4697]: Detect Proxy Usage: NO Nov 17 21:03:54 nospam snort[4697]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:03:54 nospam snort[4697]: IIS Unicode Map Codepage: 1252 Nov 17 21:03:54 nospam snort[4697]: DEFAULT SERVER CONFIG: Nov 17 21:03:54 nospam snort[4697]: Server profile: All Nov 17 21:03:54 nospam snort[4697]: Ports: 80 8080 8180 Nov 17 21:03:54 nospam snort[4697]: Flow Depth: 300 Nov 17 21:03:54 nospam snort[4697]: Max Chunk Length: 500000 Nov 17 21:03:54 nospam snort[4697]: Inspect Pipeline Requests: YES Nov 17 21:03:54 nospam snort[4697]: URI Discovery Strict Mode: NO Nov 17 21:03:54 nospam snort[4697]: Allow Proxy Usage: NO Nov 17 21:03:54 nospam snort[4697]: Disable Alerting: NO Nov 17 21:03:54 nospam snort[4697]: Oversize Dir Length: 500 Nov 17 21:03:54 nospam snort[4697]: Only inspect URI: NO Nov 17 21:03:54 nospam snort[4697]: Ascii: YES alert: NO Nov 17 21:03:54 nospam snort[4697]: Double Decoding: YES alert: YES Nov 17 21:03:54 nospam snort[4697]: %U Encoding: YES alert: YES Nov 17 21:03:54 nospam snort[4697]: Bare Byte: YES alert: YES Nov 17 21:03:54 nospam snort[4697]: Base36: OFF Nov 17 21:03:54 nospam snort[4697]: UTF 8: OFF Nov 17 21:03:54 nospam snort[4697]: IIS Unicode: YES alert: YES Nov 17 21:03:54 nospam snort[4697]: Multiple Slash: YES alert: NO Nov 17 21:03:54 nospam snort[4697]: IIS Backslash: YES alert: NO Nov 17 21:03:54 nospam snort[4697]: Directory Traversal: YES alert: NO Nov 17 21:03:54 nospam snort[4697]: Web Root Traversal: YES alert: YES Nov 17 21:03:54 nospam snort[4697]: Apache WhiteSpace: YES alert: NO Nov 17 21:03:54 nospam snort[4697]: IIS Delimiter: YES alert: NO Nov 17 21:03:54 nospam snort[4697]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:03:54 nospam snort[4697]: Non-RFC Compliant Characters: NONE Nov 17 21:03:54 nospam snort[4697]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:03:54 nospam snort[4697]: rpc_decode arguments: Nov 17 21:03:54 nospam snort[4697]: Ports to decode RPC on: 111 32771 Nov 17 21:03:54 nospam snort[4697]: alert_fragments: INACTIVE Nov 17 21:03:54 nospam snort[4697]: alert_large_fragments: ACTIVE Nov 17 21:03:54 nospam snort[4697]: alert_incomplete: ACTIVE Nov 17 21:03:54 nospam snort[4697]: alert_multiple_requests: ACTIVE Nov 17 21:03:54 nospam snort[4697]: Portscan Detection Config: Nov 17 21:03:54 nospam snort[4697]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:03:54 nospam snort[4697]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:03:54 nospam snort[4697]: Sensitivity Level: Low Nov 17 21:03:54 nospam snort[4697]: Memcap (in bytes): 10000000 Nov 17 21:03:54 nospam snort[4697]: Number of Nodes: 26109 Nov 17 21:03:54 nospam snort[4697]: Nov 17 21:03:54 nospam snort[4697]: FATAL ERROR: Unable to open rules file: /etc/snort/rules/community-inappropiate.rules or /etc/snort//etc/snort/rules/community-inappropiate.rules Nov 17 21:07:34 nospam snort[5105]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:07:34 nospam snort[5105]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:07:34 nospam snort[5105]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:07:34 nospam snort[5105]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:07:34 nospam snort[5105]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:07:34 nospam snort[5105]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:07:34 nospam snort[5105]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:07:34 nospam snort[5105]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:07:34 nospam snort[5105]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:07:34 nospam snort[5105]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:07:34 nospam snort[5105]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:07:34 nospam snort[5105]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:07:34 nospam snort[5105]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:07:34 nospam snort[5105]: Var 'HOME_NET' redefined Nov 17 21:07:34 nospam snort[5105]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:07:34 nospam snort[5105]: , value = any Nov 17 21:07:34 nospam snort[5105]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:07:34 nospam snort[5105]: , value = [192.168.1.0/24] Nov 17 21:07:34 nospam snort[5105]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:07:34 nospam snort[5105]: , value = [192.168.1.0/24] Nov 17 21:07:34 nospam snort[5105]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:07:34 nospam snort[5105]: , value = [192.168.1.0/24] Nov 17 21:07:34 nospam snort[5105]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:07:34 nospam snort[5105]: , value = [192.168.1.0/24] Nov 17 21:07:34 nospam snort[5105]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:07:34 nospam snort[5105]: , value = [192.168.1.0/24] Nov 17 21:07:34 nospam snort[5105]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:07:34 nospam snort[5105]: , value = [192.168.1.0/24] Nov 17 21:07:34 nospam snort[5105]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:07:34 nospam snort[5105]: , value = 80 Nov 17 21:07:34 nospam snort[5105]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:07:34 nospam snort[5105]: , value = !80 Nov 17 21:07:34 nospam snort[5105]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:07:34 nospam snort[5105]: , value = 1521 Nov 17 21:07:34 nospam snort[5105]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:07:34 nospam snort[5105]: Nov 17 21:07:34 nospam snort[5105]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:07:34 nospam snort[5105]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:07:34 nospam snort[5105]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:07:34 nospam snort[5105]: , value = /etc/snort/rules Nov 17 21:07:34 nospam snort[5105]: ,-----------[Flow Config]---------------------- Nov 17 21:07:34 nospam snort[5105]: | Stats Interval: 0 Nov 17 21:07:34 nospam snort[5105]: | Hash Method: 2 Nov 17 21:07:34 nospam snort[5105]: | Memcap: 10485760 Nov 17 21:07:34 nospam snort[5105]: | Rows : 4099 Nov 17 21:07:34 nospam snort[5105]: | Overhead Bytes: 32800(%0.31) Nov 17 21:07:34 nospam snort[5105]: `---------------------------------------------- Nov 17 21:07:34 nospam snort[5105]: Frag3 global config: Nov 17 21:07:34 nospam snort[5105]: Max frags: 65536 Nov 17 21:07:34 nospam snort[5105]: Fragment memory cap: 4194304 bytes Nov 17 21:07:34 nospam snort[5105]: Frag3 engine config: Nov 17 21:07:34 nospam snort[5105]: Target-based policy: FIRST Nov 17 21:07:34 nospam snort[5105]: Fragment timeout: 60 seconds Nov 17 21:07:34 nospam snort[5105]: Fragment min_ttl: 1 Nov 17 21:07:34 nospam snort[5105]: Fragment ttl_limit: 5 Nov 17 21:07:34 nospam snort[5105]: Fragment Problems: 1 Nov 17 21:07:34 nospam snort[5105]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:07:34 nospam snort[5105]: Stream5 global config: Nov 17 21:07:34 nospam snort[5105]: Track TCP sessions: ACTIVE Nov 17 21:07:34 nospam snort[5105]: Max TCP sessions: 8192 Nov 17 21:07:34 nospam snort[5105]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:07:34 nospam snort[5105]: Track UDP sessions: INACTIVE Nov 17 21:07:34 nospam snort[5105]: Track ICMP sessions: INACTIVE Nov 17 21:07:34 nospam snort[5105]: Stream5 TCP Policy config: Nov 17 21:07:34 nospam snort[5105]: Reassembly Policy: FIRST Nov 17 21:07:34 nospam snort[5105]: Timeout: 30 seconds Nov 17 21:07:34 nospam snort[5105]: Min ttl: 1 Nov 17 21:07:34 nospam snort[5105]: Options: Nov 17 21:07:34 nospam snort[5105]: Static Flushpoint Sizes: YES Nov 17 21:07:34 nospam snort[5105]: Reassembly Ports: Nov 17 21:07:34 nospam snort[5105]: 21 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 23 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 25 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 42 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 53 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 80 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 110 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 111 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 135 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 136 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 137 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 139 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 143 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 445 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 513 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 1433 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 1521 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: 3306 client (Footprint) Nov 17 21:07:34 nospam snort[5105]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:07:34 nospam snort[5105]: HttpInspect Config: Nov 17 21:07:34 nospam snort[5105]: GLOBAL CONFIG Nov 17 21:07:34 nospam snort[5105]: Max Pipeline Requests: 0 Nov 17 21:07:34 nospam snort[5105]: Inspection Type: STATELESS Nov 17 21:07:34 nospam snort[5105]: Detect Proxy Usage: NO Nov 17 21:07:34 nospam snort[5105]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:07:34 nospam snort[5105]: IIS Unicode Map Codepage: 1252 Nov 17 21:07:34 nospam snort[5105]: DEFAULT SERVER CONFIG: Nov 17 21:07:34 nospam snort[5105]: Server profile: All Nov 17 21:07:34 nospam snort[5105]: Ports: 80 8080 8180 Nov 17 21:07:34 nospam snort[5105]: Flow Depth: 300 Nov 17 21:07:34 nospam snort[5105]: Max Chunk Length: 500000 Nov 17 21:07:34 nospam snort[5105]: Inspect Pipeline Requests: YES Nov 17 21:07:34 nospam snort[5105]: URI Discovery Strict Mode: NO Nov 17 21:07:34 nospam snort[5105]: Allow Proxy Usage: NO Nov 17 21:07:34 nospam snort[5105]: Disable Alerting: NO Nov 17 21:07:34 nospam snort[5105]: Oversize Dir Length: 500 Nov 17 21:07:34 nospam snort[5105]: Only inspect URI: NO Nov 17 21:07:34 nospam snort[5105]: Ascii: YES alert: NO Nov 17 21:07:34 nospam snort[5105]: Double Decoding: YES alert: YES Nov 17 21:07:34 nospam snort[5105]: %U Encoding: YES alert: YES Nov 17 21:07:34 nospam snort[5105]: Bare Byte: YES alert: YES Nov 17 21:07:34 nospam snort[5105]: Base36: OFF Nov 17 21:07:34 nospam snort[5105]: UTF 8: OFF Nov 17 21:07:34 nospam snort[5105]: IIS Unicode: YES alert: YES Nov 17 21:07:34 nospam snort[5105]: Multiple Slash: YES alert: NO Nov 17 21:07:34 nospam snort[5105]: IIS Backslash: YES alert: NO Nov 17 21:07:34 nospam snort[5105]: Directory Traversal: YES alert: NO Nov 17 21:07:34 nospam snort[5105]: Web Root Traversal: YES alert: YES Nov 17 21:07:34 nospam snort[5105]: Apache WhiteSpace: YES alert: NO Nov 17 21:07:34 nospam snort[5105]: IIS Delimiter: YES alert: NO Nov 17 21:07:34 nospam snort[5105]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:07:34 nospam snort[5105]: Non-RFC Compliant Characters: NONE Nov 17 21:07:34 nospam snort[5105]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:07:34 nospam snort[5105]: rpc_decode arguments: Nov 17 21:07:34 nospam snort[5105]: Ports to decode RPC on: 111 32771 Nov 17 21:07:34 nospam snort[5105]: alert_fragments: INACTIVE Nov 17 21:07:34 nospam snort[5105]: alert_large_fragments: ACTIVE Nov 17 21:07:34 nospam snort[5105]: alert_incomplete: ACTIVE Nov 17 21:07:34 nospam snort[5105]: alert_multiple_requests: ACTIVE Nov 17 21:07:34 nospam snort[5105]: Portscan Detection Config: Nov 17 21:07:34 nospam snort[5105]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:07:34 nospam snort[5105]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:07:34 nospam snort[5105]: Sensitivity Level: Low Nov 17 21:07:34 nospam snort[5105]: Memcap (in bytes): 10000000 Nov 17 21:07:34 nospam snort[5105]: Number of Nodes: 26109 Nov 17 21:07:34 nospam snort[5105]: Nov 17 21:07:34 nospam snort[5105]: FATAL ERROR: Unable to open rules file: /etc/snort/rules/community-inappropiate.rules or /etc/snort//etc/snort/rules/community-inappropiate.rules Nov 17 21:12:12 nospam snort[5407]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:12:12 nospam snort[5407]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:12:12 nospam snort[5407]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:12:12 nospam snort[5407]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:12:12 nospam snort[5407]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:12:12 nospam snort[5407]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:12:12 nospam snort[5407]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:12:12 nospam snort[5407]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:12:12 nospam snort[5407]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:12:12 nospam snort[5407]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:12:12 nospam snort[5407]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:12:12 nospam snort[5407]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:12:12 nospam snort[5407]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:12:12 nospam snort[5407]: Var 'HOME_NET' redefined Nov 17 21:12:12 nospam snort[5407]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:12:12 nospam snort[5407]: , value = any Nov 17 21:12:12 nospam snort[5407]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:12:12 nospam snort[5407]: , value = [192.168.1.0/24] Nov 17 21:12:12 nospam snort[5407]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:12:12 nospam snort[5407]: , value = [192.168.1.0/24] Nov 17 21:12:12 nospam snort[5407]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:12:12 nospam snort[5407]: , value = [192.168.1.0/24] Nov 17 21:12:12 nospam snort[5407]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:12:12 nospam snort[5407]: , value = [192.168.1.0/24] Nov 17 21:12:12 nospam snort[5407]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:12:12 nospam snort[5407]: , value = [192.168.1.0/24] Nov 17 21:12:12 nospam snort[5407]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:12:12 nospam snort[5407]: , value = [192.168.1.0/24] Nov 17 21:12:12 nospam snort[5407]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:12:12 nospam snort[5407]: , value = 80 Nov 17 21:12:12 nospam snort[5407]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:12:12 nospam snort[5407]: , value = !80 Nov 17 21:12:12 nospam snort[5407]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:12:12 nospam snort[5407]: , value = 1521 Nov 17 21:12:12 nospam snort[5407]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:12:12 nospam snort[5407]: Nov 17 21:12:12 nospam snort[5407]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:12:12 nospam snort[5407]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:12:12 nospam snort[5407]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:12:12 nospam snort[5407]: , value = /etc/snort/rules Nov 17 21:12:12 nospam snort[5407]: ,-----------[Flow Config]---------------------- Nov 17 21:12:12 nospam snort[5407]: | Stats Interval: 0 Nov 17 21:12:12 nospam snort[5407]: | Hash Method: 2 Nov 17 21:12:12 nospam snort[5407]: | Memcap: 10485760 Nov 17 21:12:12 nospam snort[5407]: | Rows : 4099 Nov 17 21:12:12 nospam snort[5407]: | Overhead Bytes: 32800(%0.31) Nov 17 21:12:12 nospam snort[5407]: `---------------------------------------------- Nov 17 21:12:12 nospam snort[5407]: Frag3 global config: Nov 17 21:12:12 nospam snort[5407]: Max frags: 65536 Nov 17 21:12:12 nospam snort[5407]: Fragment memory cap: 4194304 bytes Nov 17 21:12:12 nospam snort[5407]: Frag3 engine config: Nov 17 21:12:12 nospam snort[5407]: Target-based policy: FIRST Nov 17 21:12:12 nospam snort[5407]: Fragment timeout: 60 seconds Nov 17 21:12:12 nospam snort[5407]: Fragment min_ttl: 1 Nov 17 21:12:12 nospam snort[5407]: Fragment ttl_limit: 5 Nov 17 21:12:12 nospam snort[5407]: Fragment Problems: 1 Nov 17 21:12:12 nospam snort[5407]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:12:12 nospam snort[5407]: Stream5 global config: Nov 17 21:12:12 nospam snort[5407]: Track TCP sessions: ACTIVE Nov 17 21:12:12 nospam snort[5407]: Max TCP sessions: 8192 Nov 17 21:12:12 nospam snort[5407]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:12:12 nospam snort[5407]: Track UDP sessions: INACTIVE Nov 17 21:12:12 nospam snort[5407]: Track ICMP sessions: INACTIVE Nov 17 21:12:12 nospam snort[5407]: Stream5 TCP Policy config: Nov 17 21:12:12 nospam snort[5407]: Reassembly Policy: FIRST Nov 17 21:12:12 nospam snort[5407]: Timeout: 30 seconds Nov 17 21:12:12 nospam snort[5407]: Min ttl: 1 Nov 17 21:12:12 nospam snort[5407]: Options: Nov 17 21:12:12 nospam snort[5407]: Static Flushpoint Sizes: YES Nov 17 21:12:12 nospam snort[5407]: Reassembly Ports: Nov 17 21:12:12 nospam snort[5407]: 21 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 23 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 25 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 42 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 53 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 80 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 110 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 111 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 135 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 136 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 137 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 139 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 143 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 445 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 513 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 1433 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 1521 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: 3306 client (Footprint) Nov 17 21:12:12 nospam snort[5407]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:12:12 nospam snort[5407]: HttpInspect Config: Nov 17 21:12:12 nospam snort[5407]: GLOBAL CONFIG Nov 17 21:12:12 nospam snort[5407]: Max Pipeline Requests: 0 Nov 17 21:12:12 nospam snort[5407]: Inspection Type: STATELESS Nov 17 21:12:12 nospam snort[5407]: Detect Proxy Usage: NO Nov 17 21:12:12 nospam snort[5407]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:12:12 nospam snort[5407]: IIS Unicode Map Codepage: 1252 Nov 17 21:12:12 nospam snort[5407]: DEFAULT SERVER CONFIG: Nov 17 21:12:12 nospam snort[5407]: Server profile: All Nov 17 21:12:12 nospam snort[5407]: Ports: 80 8080 8180 Nov 17 21:12:12 nospam snort[5407]: Flow Depth: 300 Nov 17 21:12:12 nospam snort[5407]: Max Chunk Length: 500000 Nov 17 21:12:12 nospam snort[5407]: Inspect Pipeline Requests: YES Nov 17 21:12:12 nospam snort[5407]: URI Discovery Strict Mode: NO Nov 17 21:12:12 nospam snort[5407]: Allow Proxy Usage: NO Nov 17 21:12:12 nospam snort[5407]: Disable Alerting: NO Nov 17 21:12:12 nospam snort[5407]: Oversize Dir Length: 500 Nov 17 21:12:12 nospam snort[5407]: Only inspect URI: NO Nov 17 21:12:12 nospam snort[5407]: Ascii: YES alert: NO Nov 17 21:12:12 nospam snort[5407]: Double Decoding: YES alert: YES Nov 17 21:12:12 nospam snort[5407]: %U Encoding: YES alert: YES Nov 17 21:12:12 nospam snort[5407]: Bare Byte: YES alert: YES Nov 17 21:12:12 nospam snort[5407]: Base36: OFF Nov 17 21:12:12 nospam snort[5407]: UTF 8: OFF Nov 17 21:12:12 nospam snort[5407]: IIS Unicode: YES alert: YES Nov 17 21:12:12 nospam snort[5407]: Multiple Slash: YES alert: NO Nov 17 21:12:12 nospam snort[5407]: IIS Backslash: YES alert: NO Nov 17 21:12:12 nospam snort[5407]: Directory Traversal: YES alert: NO Nov 17 21:12:12 nospam snort[5407]: Web Root Traversal: YES alert: YES Nov 17 21:12:12 nospam snort[5407]: Apache WhiteSpace: YES alert: NO Nov 17 21:12:12 nospam snort[5407]: IIS Delimiter: YES alert: NO Nov 17 21:12:12 nospam snort[5407]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:12:12 nospam snort[5407]: Non-RFC Compliant Characters: NONE Nov 17 21:12:12 nospam snort[5407]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:12:12 nospam snort[5407]: rpc_decode arguments: Nov 17 21:12:12 nospam snort[5407]: Ports to decode RPC on: 111 32771 Nov 17 21:12:12 nospam snort[5407]: alert_fragments: INACTIVE Nov 17 21:12:12 nospam snort[5407]: alert_large_fragments: ACTIVE Nov 17 21:12:12 nospam snort[5407]: alert_incomplete: ACTIVE Nov 17 21:12:12 nospam snort[5407]: alert_multiple_requests: ACTIVE Nov 17 21:12:12 nospam snort[5407]: Portscan Detection Config: Nov 17 21:12:12 nospam snort[5407]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:12:12 nospam snort[5407]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:12:12 nospam snort[5407]: Sensitivity Level: Low Nov 17 21:12:12 nospam snort[5407]: Memcap (in bytes): 10000000 Nov 17 21:12:12 nospam snort[5407]: Number of Nodes: 26109 Nov 17 21:12:12 nospam snort[5407]: Nov 17 21:12:12 nospam snort[5407]: Tagged Packet Limit: 256 Nov 17 21:12:12 nospam snort[5407]: Nov 17 21:12:12 nospam snort[5407]: +-----------------------[thresholding-config]---------------------------------- Nov 17 21:12:12 nospam snort[5407]: | memory-cap : 1048576 bytes Nov 17 21:12:12 nospam snort[5407]: +-----------------------[thresholding-global]---------------------------------- Nov 17 21:12:12 nospam snort[5407]: | none Nov 17 21:12:12 nospam snort[5407]: +-----------------------[thresholding-local]----------------------------------- Nov 17 21:12:12 nospam snort[5407]: | none Nov 17 21:12:12 nospam snort[5407]: +-----------------------[suppression]------------------------------------------ Nov 17 21:12:12 nospam snort[5407]: | none Nov 17 21:12:12 nospam snort[5407]: ------------------------------------------------------------------------------- Nov 17 21:12:12 nospam snort[5407]: Rule application order: activation->dynamic->pass->drop->alert->log Nov 17 21:12:12 nospam snort[5407]: Log directory = /var/log/snort Nov 17 21:12:12 nospam snort[5407]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Nov 17 21:12:12 nospam snort[5407]: done Nov 17 21:12:12 nospam snort[5407]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Nov 17 21:12:12 nospam snort[5407]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 17 21:12:12 nospam snort[5407]: done Nov 17 21:12:12 nospam snort[5407]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 17 21:12:12 nospam snort[5407]: done Nov 17 21:12:12 nospam snort[5407]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... Nov 17 21:12:12 nospam snort[5407]: done Nov 17 21:12:12 nospam snort[5407]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 17 21:12:12 nospam snort[5407]: done Nov 17 21:12:12 nospam snort[5407]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Nov 17 21:12:12 nospam snort[5407]: done Nov 17 21:12:12 nospam snort[5407]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Nov 17 21:12:12 nospam snort[5407]: FTPTelnet Config: Nov 17 21:12:12 nospam snort[5407]: GLOBAL CONFIG Nov 17 21:12:12 nospam snort[5407]: Inspection Type: stateful Nov 17 21:12:12 nospam snort[5407]: Check for Encrypted Traffic: YES alert: YES Nov 17 21:12:12 nospam snort[5407]: Continue to check encrypted data: NO Nov 17 21:12:12 nospam snort[5407]: TELNET CONFIG: Nov 17 21:12:12 nospam snort[5407]: Ports: 23 Nov 17 21:12:12 nospam snort[5407]: Are You There Threshold: 200 Nov 17 21:12:12 nospam snort[5407]: Normalize: YES Nov 17 21:12:12 nospam snort[5407]: Detect Anomalies: NO Nov 17 21:12:12 nospam snort[5407]: FTP CONFIG: Nov 17 21:12:12 nospam snort[5407]: FTP Server: default Nov 17 21:12:12 nospam snort[5407]: Ports: 21 Nov 17 21:12:12 nospam snort[5407]: Check for Telnet Cmds: YES alert: YES Nov 17 21:12:12 nospam snort[5407]: Identify open data channels: YES Nov 17 21:12:12 nospam snort[5407]: FTP Client: default Nov 17 21:12:12 nospam snort[5407]: Check for Bounce Attacks: YES alert: YES Nov 17 21:12:12 nospam snort[5407]: Check for Telnet Cmds: YES alert: YES Nov 17 21:12:12 nospam snort[5407]: Max Response Length: 256 Nov 17 21:12:12 nospam snort[5407]: SMTP Config: Nov 17 21:12:12 nospam snort[5407]: Ports: Nov 17 21:12:12 nospam snort[5407]: 25 Nov 17 21:12:12 nospam snort[5407]: Nov 17 21:12:12 nospam snort[5407]: Inspection Type: STATEFUL Nov 17 21:12:12 nospam snort[5407]: Normalize Spaces: YES Nov 17 21:12:12 nospam snort[5407]: Ignore Data: NO Nov 17 21:12:12 nospam snort[5407]: Ignore TLS Data: NO Nov 17 21:12:12 nospam snort[5407]: Ignore Alerts: NO Nov 17 21:12:12 nospam snort[5407]: Max Command Length: 0 Nov 17 21:12:12 nospam snort[5407]: Max Header Line Length: 0 Nov 17 21:12:12 nospam snort[5407]: Max Response Line Length: 0 Nov 17 21:12:12 nospam snort[5407]: X-Link2State Alert: YES Nov 17 21:12:12 nospam snort[5407]: Drop on X-Link2State Alert: NO Nov 17 21:12:12 nospam snort[5407]: DCE/RPC Decoder config: Nov 17 21:12:12 nospam snort[5407]: Autodetect ports ENABLED Nov 17 21:12:12 nospam snort[5407]: SMB fragmentation ENABLED Nov 17 21:12:12 nospam snort[5407]: DCE/RPC fragmentation ENABLED Nov 17 21:12:12 nospam snort[5407]: Max Frag Size: 3000 bytes Nov 17 21:12:12 nospam snort[5407]: Memcap: 100000 KB Nov 17 21:12:12 nospam snort[5407]: Alert if memcap exceeded DISABLED Nov 17 21:12:12 nospam snort[5407]: Nov 17 21:12:12 nospam snort[5407]: DNS config: Nov 17 21:12:12 nospam snort[5407]: DNS Client rdata txt Overflow Alert: ACTIVE Nov 17 21:12:12 nospam snort[5407]: Obsolete DNS RR Types Alert: INACTIVE Nov 17 21:12:12 nospam snort[5407]: Experimental DNS RR Types Alert: INACTIVE Nov 17 21:12:12 nospam snort[5407]: Ports: Nov 17 21:12:12 nospam snort[5407]: 53 Nov 17 21:12:12 nospam snort[5407]: Nov 17 21:12:13 nospam snort[5407]: Warning: flowbits key 'community_uri.size.1050' is set but not ever checked. Nov 17 21:12:13 nospam snort[5407]: 295 out of 512 flowbits in use. Nov 17 21:12:13 nospam snort[5407]: Initializing daemon mode Nov 17 21:12:13 nospam snort[5409]: PID path stat checked out ok, PID path set to /var/run/ Nov 17 21:12:13 nospam snort[5409]: Writing PID "5409" to file "/var/run//snort_eth0.pid" Nov 17 21:12:13 nospam snort[5407]: Daemon parent exiting Nov 17 21:12:13 nospam snort[5409]: Daemon initialized, signaled parent pid: 5407 Nov 17 21:12:56 nospam snort[5482]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:12:56 nospam snort[5482]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:12:56 nospam snort[5482]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:12:56 nospam snort[5482]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:12:56 nospam snort[5482]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:12:56 nospam snort[5482]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:12:56 nospam snort[5482]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:12:56 nospam snort[5482]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:12:56 nospam snort[5482]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:12:56 nospam snort[5482]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:12:56 nospam snort[5482]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:12:56 nospam snort[5482]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:12:56 nospam snort[5482]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:12:56 nospam snort[5482]: Var 'HOME_NET' redefined Nov 17 21:12:56 nospam snort[5482]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:12:56 nospam snort[5482]: , value = any Nov 17 21:12:56 nospam snort[5482]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:12:56 nospam snort[5482]: , value = [192.168.1.0/24] Nov 17 21:12:56 nospam snort[5482]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:12:56 nospam snort[5482]: , value = [192.168.1.0/24] Nov 17 21:12:56 nospam snort[5482]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:12:56 nospam snort[5482]: , value = [192.168.1.0/24] Nov 17 21:12:56 nospam snort[5482]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:12:56 nospam snort[5482]: , value = [192.168.1.0/24] Nov 17 21:12:56 nospam snort[5482]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:12:56 nospam snort[5482]: , value = [192.168.1.0/24] Nov 17 21:12:56 nospam snort[5482]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:12:56 nospam snort[5482]: , value = [192.168.1.0/24] Nov 17 21:12:56 nospam snort[5482]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:12:56 nospam snort[5482]: , value = 80 Nov 17 21:12:56 nospam snort[5482]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:12:56 nospam snort[5482]: , value = !80 Nov 17 21:12:56 nospam snort[5482]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:12:56 nospam snort[5482]: , value = 1521 Nov 17 21:12:56 nospam snort[5482]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:12:56 nospam snort[5482]: Nov 17 21:12:56 nospam snort[5482]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:12:56 nospam snort[5482]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:12:56 nospam snort[5482]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:12:56 nospam snort[5482]: , value = /etc/snort/rules Nov 17 21:12:56 nospam snort[5482]: ,-----------[Flow Config]---------------------- Nov 17 21:12:56 nospam snort[5482]: | Stats Interval: 0 Nov 17 21:12:56 nospam snort[5482]: | Hash Method: 2 Nov 17 21:12:56 nospam snort[5482]: | Memcap: 10485760 Nov 17 21:12:56 nospam snort[5482]: | Rows : 4099 Nov 17 21:12:56 nospam snort[5482]: | Overhead Bytes: 32800(%0.31) Nov 17 21:12:56 nospam snort[5482]: `---------------------------------------------- Nov 17 21:12:56 nospam snort[5482]: Frag3 global config: Nov 17 21:12:56 nospam snort[5482]: Max frags: 65536 Nov 17 21:12:56 nospam snort[5482]: Fragment memory cap: 4194304 bytes Nov 17 21:12:56 nospam snort[5482]: Frag3 engine config: Nov 17 21:12:56 nospam snort[5482]: Target-based policy: FIRST Nov 17 21:12:56 nospam snort[5482]: Fragment timeout: 60 seconds Nov 17 21:12:56 nospam snort[5482]: Fragment min_ttl: 1 Nov 17 21:12:56 nospam snort[5482]: Fragment ttl_limit: 5 Nov 17 21:12:56 nospam snort[5482]: Fragment Problems: 1 Nov 17 21:12:56 nospam snort[5482]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:12:56 nospam snort[5482]: Stream5 global config: Nov 17 21:12:56 nospam snort[5482]: Track TCP sessions: ACTIVE Nov 17 21:12:56 nospam snort[5482]: Max TCP sessions: 8192 Nov 17 21:12:56 nospam snort[5482]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:12:56 nospam snort[5482]: Track UDP sessions: INACTIVE Nov 17 21:12:56 nospam snort[5482]: Track ICMP sessions: INACTIVE Nov 17 21:12:56 nospam snort[5482]: Stream5 TCP Policy config: Nov 17 21:12:56 nospam snort[5482]: Reassembly Policy: FIRST Nov 17 21:12:56 nospam snort[5482]: Timeout: 30 seconds Nov 17 21:12:56 nospam snort[5482]: Min ttl: 1 Nov 17 21:12:56 nospam snort[5482]: Options: Nov 17 21:12:56 nospam snort[5482]: Static Flushpoint Sizes: YES Nov 17 21:12:56 nospam snort[5482]: Reassembly Ports: Nov 17 21:12:56 nospam snort[5482]: 21 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 23 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 25 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 42 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 53 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 80 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 110 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 111 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 135 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 136 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 137 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 139 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 143 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 445 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 513 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 1433 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 1521 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: 3306 client (Footprint) Nov 17 21:12:56 nospam snort[5482]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:12:56 nospam snort[5482]: HttpInspect Config: Nov 17 21:12:56 nospam snort[5482]: GLOBAL CONFIG Nov 17 21:12:56 nospam snort[5482]: Max Pipeline Requests: 0 Nov 17 21:12:56 nospam snort[5482]: Inspection Type: STATELESS Nov 17 21:12:56 nospam snort[5482]: Detect Proxy Usage: NO Nov 17 21:12:56 nospam snort[5482]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:12:56 nospam snort[5482]: IIS Unicode Map Codepage: 1252 Nov 17 21:12:56 nospam snort[5482]: DEFAULT SERVER CONFIG: Nov 17 21:12:56 nospam snort[5482]: Server profile: All Nov 17 21:12:56 nospam snort[5482]: Ports: 80 8080 8180 Nov 17 21:12:56 nospam snort[5482]: Flow Depth: 300 Nov 17 21:12:56 nospam snort[5482]: Max Chunk Length: 500000 Nov 17 21:12:56 nospam snort[5482]: Inspect Pipeline Requests: YES Nov 17 21:12:56 nospam snort[5482]: URI Discovery Strict Mode: NO Nov 17 21:12:56 nospam snort[5482]: Allow Proxy Usage: NO Nov 17 21:12:56 nospam snort[5482]: Disable Alerting: NO Nov 17 21:12:56 nospam snort[5482]: Oversize Dir Length: 500 Nov 17 21:12:56 nospam snort[5482]: Only inspect URI: NO Nov 17 21:12:56 nospam snort[5482]: Ascii: YES alert: NO Nov 17 21:12:56 nospam snort[5482]: Double Decoding: YES alert: YES Nov 17 21:12:56 nospam snort[5482]: %U Encoding: YES alert: YES Nov 17 21:12:56 nospam snort[5482]: Bare Byte: YES alert: YES Nov 17 21:12:56 nospam snort[5482]: Base36: OFF Nov 17 21:12:56 nospam snort[5482]: UTF 8: OFF Nov 17 21:12:56 nospam snort[5482]: IIS Unicode: YES alert: YES Nov 17 21:12:56 nospam snort[5482]: Multiple Slash: YES alert: NO Nov 17 21:12:56 nospam snort[5482]: IIS Backslash: YES alert: NO Nov 17 21:12:56 nospam snort[5482]: Directory Traversal: YES alert: NO Nov 17 21:12:56 nospam snort[5482]: Web Root Traversal: YES alert: YES Nov 17 21:12:56 nospam snort[5482]: Apache WhiteSpace: YES alert: NO Nov 17 21:12:56 nospam snort[5482]: IIS Delimiter: YES alert: NO Nov 17 21:12:56 nospam snort[5482]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:12:56 nospam snort[5482]: Non-RFC Compliant Characters: NONE Nov 17 21:12:56 nospam snort[5482]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:12:56 nospam snort[5482]: rpc_decode arguments: Nov 17 21:12:56 nospam snort[5482]: Ports to decode RPC on: 111 32771 Nov 17 21:12:56 nospam snort[5482]: alert_fragments: INACTIVE Nov 17 21:12:56 nospam snort[5482]: alert_large_fragments: ACTIVE Nov 17 21:12:56 nospam snort[5482]: alert_incomplete: ACTIVE Nov 17 21:12:56 nospam snort[5482]: alert_multiple_requests: ACTIVE Nov 17 21:12:56 nospam snort[5482]: Portscan Detection Config: Nov 17 21:12:56 nospam snort[5482]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:12:56 nospam snort[5482]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:12:56 nospam snort[5482]: Sensitivity Level: Low Nov 17 21:12:56 nospam snort[5482]: Memcap (in bytes): 10000000 Nov 17 21:12:56 nospam snort[5482]: Number of Nodes: 26109 Nov 17 21:12:56 nospam snort[5482]: Nov 17 21:12:56 nospam snort[5482]: Tagged Packet Limit: 256 Nov 17 21:12:56 nospam snort[5482]: Nov 17 21:12:56 nospam snort[5482]: +-----------------------[thresholding-config]---------------------------------- Nov 17 21:12:56 nospam snort[5482]: | memory-cap : 1048576 bytes Nov 17 21:12:56 nospam snort[5482]: +-----------------------[thresholding-global]---------------------------------- Nov 17 21:12:56 nospam snort[5482]: | none Nov 17 21:12:56 nospam snort[5482]: +-----------------------[thresholding-local]----------------------------------- Nov 17 21:12:56 nospam snort[5482]: | none Nov 17 21:12:56 nospam snort[5482]: +-----------------------[suppression]------------------------------------------ Nov 17 21:12:56 nospam snort[5482]: | none Nov 17 21:12:56 nospam snort[5482]: ------------------------------------------------------------------------------- Nov 17 21:12:56 nospam snort[5482]: Rule application order: activation->dynamic->pass->drop->alert->log Nov 17 21:12:56 nospam snort[5482]: Log directory = /var/log/snort Nov 17 21:12:56 nospam snort[5482]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Nov 17 21:12:56 nospam snort[5482]: done Nov 17 21:12:56 nospam snort[5482]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Nov 17 21:12:56 nospam snort[5482]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 17 21:12:56 nospam snort[5482]: done Nov 17 21:12:56 nospam snort[5482]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 17 21:12:56 nospam snort[5482]: done Nov 17 21:12:56 nospam snort[5482]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... Nov 17 21:12:56 nospam snort[5482]: done Nov 17 21:12:56 nospam snort[5482]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 17 21:12:56 nospam snort[5482]: done Nov 17 21:12:56 nospam snort[5482]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Nov 17 21:12:56 nospam snort[5482]: done Nov 17 21:12:56 nospam snort[5482]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Nov 17 21:12:56 nospam snort[5482]: FTPTelnet Config: Nov 17 21:12:56 nospam snort[5482]: GLOBAL CONFIG Nov 17 21:12:56 nospam snort[5482]: Inspection Type: stateful Nov 17 21:12:56 nospam snort[5482]: Check for Encrypted Traffic: YES alert: YES Nov 17 21:12:56 nospam snort[5482]: Continue to check encrypted data: NO Nov 17 21:12:56 nospam snort[5482]: TELNET CONFIG: Nov 17 21:12:56 nospam snort[5482]: Ports: 23 Nov 17 21:12:56 nospam snort[5482]: Are You There Threshold: 200 Nov 17 21:12:56 nospam snort[5482]: Normalize: YES Nov 17 21:12:56 nospam snort[5482]: Detect Anomalies: NO Nov 17 21:12:56 nospam snort[5482]: FTP CONFIG: Nov 17 21:12:56 nospam snort[5482]: FTP Server: default Nov 17 21:12:56 nospam snort[5482]: Ports: 21 Nov 17 21:12:56 nospam snort[5482]: Check for Telnet Cmds: YES alert: YES Nov 17 21:12:56 nospam snort[5482]: Identify open data channels: YES Nov 17 21:12:56 nospam snort[5482]: FTP Client: default Nov 17 21:12:56 nospam snort[5482]: Check for Bounce Attacks: YES alert: YES Nov 17 21:12:56 nospam snort[5482]: Check for Telnet Cmds: YES alert: YES Nov 17 21:12:56 nospam snort[5482]: Max Response Length: 256 Nov 17 21:12:56 nospam snort[5482]: SMTP Config: Nov 17 21:12:56 nospam snort[5482]: Ports: Nov 17 21:12:56 nospam snort[5482]: 25 Nov 17 21:12:56 nospam snort[5482]: Nov 17 21:12:56 nospam snort[5482]: Inspection Type: STATEFUL Nov 17 21:12:56 nospam snort[5482]: Normalize Spaces: YES Nov 17 21:12:56 nospam snort[5482]: Ignore Data: NO Nov 17 21:12:56 nospam snort[5482]: Ignore TLS Data: NO Nov 17 21:12:56 nospam snort[5482]: Ignore Alerts: NO Nov 17 21:12:56 nospam snort[5482]: Max Command Length: 0 Nov 17 21:12:56 nospam snort[5482]: Max Header Line Length: 0 Nov 17 21:12:56 nospam snort[5482]: Max Response Line Length: 0 Nov 17 21:12:56 nospam snort[5482]: X-Link2State Alert: YES Nov 17 21:12:56 nospam snort[5482]: Drop on X-Link2State Alert: NO Nov 17 21:12:56 nospam snort[5482]: DCE/RPC Decoder config: Nov 17 21:12:56 nospam snort[5482]: Autodetect ports ENABLED Nov 17 21:12:56 nospam snort[5482]: SMB fragmentation ENABLED Nov 17 21:12:56 nospam snort[5482]: DCE/RPC fragmentation ENABLED Nov 17 21:12:56 nospam snort[5482]: Max Frag Size: 3000 bytes Nov 17 21:12:56 nospam snort[5482]: Memcap: 100000 KB Nov 17 21:12:56 nospam snort[5482]: Alert if memcap exceeded DISABLED Nov 17 21:12:56 nospam snort[5482]: Nov 17 21:12:56 nospam snort[5482]: DNS config: Nov 17 21:12:56 nospam snort[5482]: DNS Client rdata txt Overflow Alert: ACTIVE Nov 17 21:12:56 nospam snort[5482]: Obsolete DNS RR Types Alert: INACTIVE Nov 17 21:12:56 nospam snort[5482]: Experimental DNS RR Types Alert: INACTIVE Nov 17 21:12:56 nospam snort[5482]: Ports: Nov 17 21:12:56 nospam snort[5482]: 53 Nov 17 21:12:56 nospam snort[5482]: Nov 17 21:12:58 nospam snort[5482]: Warning: flowbits key 'community_uri.size.1050' is set but not ever checked. Nov 17 21:12:58 nospam snort[5482]: 295 out of 512 flowbits in use. Nov 17 21:12:58 nospam snort[5482]: Initializing daemon mode Nov 17 21:12:58 nospam snort[5490]: PID path stat checked out ok, PID path set to /var/run/ Nov 17 21:12:58 nospam snort[5490]: Writing PID "5490" to file "/var/run//snort_eth0.pid" Nov 17 21:12:58 nospam snort[5482]: Daemon parent exiting Nov 17 21:12:58 nospam snort[5490]: Daemon initialized, signaled parent pid: 5482 Nov 17 21:13:11 nospam snort[5536]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:13:11 nospam snort[5536]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:13:11 nospam snort[5536]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:13:11 nospam snort[5536]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:13:11 nospam snort[5536]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:13:11 nospam snort[5536]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:13:11 nospam snort[5536]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:13:11 nospam snort[5536]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:13:11 nospam snort[5536]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:13:11 nospam snort[5536]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:13:11 nospam snort[5536]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:13:11 nospam snort[5536]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:13:11 nospam snort[5536]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:13:11 nospam snort[5536]: Var 'HOME_NET' redefined Nov 17 21:13:11 nospam snort[5536]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:13:11 nospam snort[5536]: , value = any Nov 17 21:13:11 nospam snort[5536]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:13:11 nospam snort[5536]: , value = [192.168.1.0/24] Nov 17 21:13:11 nospam snort[5536]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:13:11 nospam snort[5536]: , value = [192.168.1.0/24] Nov 17 21:13:11 nospam snort[5536]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:13:11 nospam snort[5536]: , value = [192.168.1.0/24] Nov 17 21:13:11 nospam snort[5536]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:13:11 nospam snort[5536]: , value = [192.168.1.0/24] Nov 17 21:13:11 nospam snort[5536]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:13:11 nospam snort[5536]: , value = [192.168.1.0/24] Nov 17 21:13:11 nospam snort[5536]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:13:11 nospam snort[5536]: , value = [192.168.1.0/24] Nov 17 21:13:11 nospam snort[5536]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:13:11 nospam snort[5536]: , value = 80 Nov 17 21:13:11 nospam snort[5536]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:13:11 nospam snort[5536]: , value = !80 Nov 17 21:13:11 nospam snort[5536]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:13:11 nospam snort[5536]: , value = 1521 Nov 17 21:13:11 nospam snort[5536]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:13:11 nospam snort[5536]: Nov 17 21:13:11 nospam snort[5536]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:13:11 nospam snort[5536]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:13:11 nospam snort[5536]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:13:11 nospam snort[5536]: , value = /etc/snort/rules Nov 17 21:13:11 nospam snort[5536]: ,-----------[Flow Config]---------------------- Nov 17 21:13:11 nospam snort[5536]: | Stats Interval: 0 Nov 17 21:13:11 nospam snort[5536]: | Hash Method: 2 Nov 17 21:13:11 nospam snort[5536]: | Memcap: 10485760 Nov 17 21:13:11 nospam snort[5536]: | Rows : 4099 Nov 17 21:13:11 nospam snort[5536]: | Overhead Bytes: 32800(%0.31) Nov 17 21:13:11 nospam snort[5536]: `---------------------------------------------- Nov 17 21:13:11 nospam snort[5536]: Frag3 global config: Nov 17 21:13:11 nospam snort[5536]: Max frags: 65536 Nov 17 21:13:11 nospam snort[5536]: Fragment memory cap: 4194304 bytes Nov 17 21:13:11 nospam snort[5536]: Frag3 engine config: Nov 17 21:13:11 nospam snort[5536]: Target-based policy: FIRST Nov 17 21:13:11 nospam snort[5536]: Fragment timeout: 60 seconds Nov 17 21:13:11 nospam snort[5536]: Fragment min_ttl: 1 Nov 17 21:13:11 nospam snort[5536]: Fragment ttl_limit: 5 Nov 17 21:13:11 nospam snort[5536]: Fragment Problems: 1 Nov 17 21:13:11 nospam snort[5536]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:13:11 nospam snort[5536]: Stream5 global config: Nov 17 21:13:11 nospam snort[5536]: Track TCP sessions: ACTIVE Nov 17 21:13:11 nospam snort[5536]: Max TCP sessions: 8192 Nov 17 21:13:11 nospam snort[5536]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:13:11 nospam snort[5536]: Track UDP sessions: INACTIVE Nov 17 21:13:11 nospam snort[5536]: Track ICMP sessions: INACTIVE Nov 17 21:13:11 nospam snort[5536]: Stream5 TCP Policy config: Nov 17 21:13:11 nospam snort[5536]: Reassembly Policy: FIRST Nov 17 21:13:11 nospam snort[5536]: Timeout: 30 seconds Nov 17 21:13:11 nospam snort[5536]: Min ttl: 1 Nov 17 21:13:11 nospam snort[5536]: Options: Nov 17 21:13:11 nospam snort[5536]: Static Flushpoint Sizes: YES Nov 17 21:13:11 nospam snort[5536]: Reassembly Ports: Nov 17 21:13:11 nospam snort[5536]: 21 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 23 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 25 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 42 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 53 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 80 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 110 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 111 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 135 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 136 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 137 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 139 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 143 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 445 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 513 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 1433 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 1521 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: 3306 client (Footprint) Nov 17 21:13:11 nospam snort[5536]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:13:11 nospam snort[5536]: HttpInspect Config: Nov 17 21:13:11 nospam snort[5536]: GLOBAL CONFIG Nov 17 21:13:11 nospam snort[5536]: Max Pipeline Requests: 0 Nov 17 21:13:11 nospam snort[5536]: Inspection Type: STATELESS Nov 17 21:13:11 nospam snort[5536]: Detect Proxy Usage: NO Nov 17 21:13:11 nospam snort[5536]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:13:11 nospam snort[5536]: IIS Unicode Map Codepage: 1252 Nov 17 21:13:11 nospam snort[5536]: DEFAULT SERVER CONFIG: Nov 17 21:13:11 nospam snort[5536]: Server profile: All Nov 17 21:13:11 nospam snort[5536]: Ports: 80 8080 8180 Nov 17 21:13:11 nospam snort[5536]: Flow Depth: 300 Nov 17 21:13:11 nospam snort[5536]: Max Chunk Length: 500000 Nov 17 21:13:11 nospam snort[5536]: Inspect Pipeline Requests: YES Nov 17 21:13:11 nospam snort[5536]: URI Discovery Strict Mode: NO Nov 17 21:13:11 nospam snort[5536]: Allow Proxy Usage: NO Nov 17 21:13:11 nospam snort[5536]: Disable Alerting: NO Nov 17 21:13:11 nospam snort[5536]: Oversize Dir Length: 500 Nov 17 21:13:11 nospam snort[5536]: Only inspect URI: NO Nov 17 21:13:11 nospam snort[5536]: Ascii: YES alert: NO Nov 17 21:13:11 nospam snort[5536]: Double Decoding: YES alert: YES Nov 17 21:13:11 nospam snort[5536]: %U Encoding: YES alert: YES Nov 17 21:13:11 nospam snort[5536]: Bare Byte: YES alert: YES Nov 17 21:13:11 nospam snort[5536]: Base36: OFF Nov 17 21:13:11 nospam snort[5536]: UTF 8: OFF Nov 17 21:13:11 nospam snort[5536]: IIS Unicode: YES alert: YES Nov 17 21:13:11 nospam snort[5536]: Multiple Slash: YES alert: NO Nov 17 21:13:11 nospam snort[5536]: IIS Backslash: YES alert: NO Nov 17 21:13:11 nospam snort[5536]: Directory Traversal: YES alert: NO Nov 17 21:13:11 nospam snort[5536]: Web Root Traversal: YES alert: YES Nov 17 21:13:11 nospam snort[5536]: Apache WhiteSpace: YES alert: NO Nov 17 21:13:11 nospam snort[5536]: IIS Delimiter: YES alert: NO Nov 17 21:13:11 nospam snort[5536]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:13:11 nospam snort[5536]: Non-RFC Compliant Characters: NONE Nov 17 21:13:11 nospam snort[5536]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:13:11 nospam snort[5536]: rpc_decode arguments: Nov 17 21:13:11 nospam snort[5536]: Ports to decode RPC on: 111 32771 Nov 17 21:13:11 nospam snort[5536]: alert_fragments: INACTIVE Nov 17 21:13:11 nospam snort[5536]: alert_large_fragments: ACTIVE Nov 17 21:13:11 nospam snort[5536]: alert_incomplete: ACTIVE Nov 17 21:13:11 nospam snort[5536]: alert_multiple_requests: ACTIVE Nov 17 21:13:11 nospam snort[5536]: Portscan Detection Config: Nov 17 21:13:11 nospam snort[5536]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:13:11 nospam snort[5536]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:13:11 nospam snort[5536]: Sensitivity Level: Low Nov 17 21:13:11 nospam snort[5536]: Memcap (in bytes): 10000000 Nov 17 21:13:11 nospam snort[5536]: Number of Nodes: 26109 Nov 17 21:13:11 nospam snort[5536]: Nov 17 21:13:11 nospam snort[5536]: FATAL ERROR: Unable to open rules file: /etc/snort/rules/community-games.rules or /etc/snort//etc/snort/rules/community-games.rules Nov 17 21:14:02 nospam snort[5612]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:14:02 nospam snort[5612]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:14:02 nospam snort[5612]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:14:02 nospam snort[5612]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:14:02 nospam snort[5612]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:14:02 nospam snort[5612]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:14:02 nospam snort[5612]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:14:02 nospam snort[5612]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:14:02 nospam snort[5612]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:14:02 nospam snort[5612]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:14:02 nospam snort[5612]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:14:02 nospam snort[5612]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:14:02 nospam snort[5612]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:14:02 nospam snort[5612]: Var 'HOME_NET' redefined Nov 17 21:14:02 nospam snort[5612]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:14:02 nospam snort[5612]: , value = any Nov 17 21:14:02 nospam snort[5612]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:14:02 nospam snort[5612]: , value = [192.168.1.0/24] Nov 17 21:14:02 nospam snort[5612]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:14:02 nospam snort[5612]: , value = [192.168.1.0/24] Nov 17 21:14:02 nospam snort[5612]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:14:02 nospam snort[5612]: , value = [192.168.1.0/24] Nov 17 21:14:02 nospam snort[5612]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:14:02 nospam snort[5612]: , value = [192.168.1.0/24] Nov 17 21:14:02 nospam snort[5612]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:14:02 nospam snort[5612]: , value = [192.168.1.0/24] Nov 17 21:14:02 nospam snort[5612]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:14:02 nospam snort[5612]: , value = [192.168.1.0/24] Nov 17 21:14:02 nospam snort[5612]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:14:02 nospam snort[5612]: , value = 80 Nov 17 21:14:02 nospam snort[5612]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:14:02 nospam snort[5612]: , value = !80 Nov 17 21:14:02 nospam snort[5612]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:14:02 nospam snort[5612]: , value = 1521 Nov 17 21:14:02 nospam snort[5612]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:14:02 nospam snort[5612]: Nov 17 21:14:02 nospam snort[5612]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:14:02 nospam snort[5612]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:14:02 nospam snort[5612]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:14:02 nospam snort[5612]: , value = /etc/snort/rules Nov 17 21:14:02 nospam snort[5612]: ,-----------[Flow Config]---------------------- Nov 17 21:14:02 nospam snort[5612]: | Stats Interval: 0 Nov 17 21:14:02 nospam snort[5612]: | Hash Method: 2 Nov 17 21:14:02 nospam snort[5612]: | Memcap: 10485760 Nov 17 21:14:02 nospam snort[5612]: | Rows : 4099 Nov 17 21:14:02 nospam snort[5612]: | Overhead Bytes: 32800(%0.31) Nov 17 21:14:02 nospam snort[5612]: `---------------------------------------------- Nov 17 21:14:02 nospam snort[5612]: Frag3 global config: Nov 17 21:14:02 nospam snort[5612]: Max frags: 65536 Nov 17 21:14:02 nospam snort[5612]: Fragment memory cap: 4194304 bytes Nov 17 21:14:02 nospam snort[5612]: Frag3 engine config: Nov 17 21:14:02 nospam snort[5612]: Target-based policy: FIRST Nov 17 21:14:02 nospam snort[5612]: Fragment timeout: 60 seconds Nov 17 21:14:02 nospam snort[5612]: Fragment min_ttl: 1 Nov 17 21:14:02 nospam snort[5612]: Fragment ttl_limit: 5 Nov 17 21:14:02 nospam snort[5612]: Fragment Problems: 1 Nov 17 21:14:02 nospam snort[5612]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:14:02 nospam snort[5612]: Stream5 global config: Nov 17 21:14:02 nospam snort[5612]: Track TCP sessions: ACTIVE Nov 17 21:14:02 nospam snort[5612]: Max TCP sessions: 8192 Nov 17 21:14:02 nospam snort[5612]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:14:02 nospam snort[5612]: Track UDP sessions: INACTIVE Nov 17 21:14:02 nospam snort[5612]: Track ICMP sessions: INACTIVE Nov 17 21:14:02 nospam snort[5612]: Stream5 TCP Policy config: Nov 17 21:14:02 nospam snort[5612]: Reassembly Policy: FIRST Nov 17 21:14:02 nospam snort[5612]: Timeout: 30 seconds Nov 17 21:14:02 nospam snort[5612]: Min ttl: 1 Nov 17 21:14:02 nospam snort[5612]: Options: Nov 17 21:14:02 nospam snort[5612]: Static Flushpoint Sizes: YES Nov 17 21:14:02 nospam snort[5612]: Reassembly Ports: Nov 17 21:14:02 nospam snort[5612]: 21 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 23 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 25 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 42 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 53 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 80 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 110 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 111 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 135 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 136 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 137 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 139 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 143 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 445 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 513 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 1433 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 1521 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: 3306 client (Footprint) Nov 17 21:14:02 nospam snort[5612]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:14:02 nospam snort[5612]: HttpInspect Config: Nov 17 21:14:02 nospam snort[5612]: GLOBAL CONFIG Nov 17 21:14:02 nospam snort[5612]: Max Pipeline Requests: 0 Nov 17 21:14:02 nospam snort[5612]: Inspection Type: STATELESS Nov 17 21:14:02 nospam snort[5612]: Detect Proxy Usage: NO Nov 17 21:14:02 nospam snort[5612]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:14:02 nospam snort[5612]: IIS Unicode Map Codepage: 1252 Nov 17 21:14:02 nospam snort[5612]: DEFAULT SERVER CONFIG: Nov 17 21:14:02 nospam snort[5612]: Server profile: All Nov 17 21:14:02 nospam snort[5612]: Ports: 80 8080 8180 Nov 17 21:14:02 nospam snort[5612]: Flow Depth: 300 Nov 17 21:14:02 nospam snort[5612]: Max Chunk Length: 500000 Nov 17 21:14:02 nospam snort[5612]: Inspect Pipeline Requests: YES Nov 17 21:14:02 nospam snort[5612]: URI Discovery Strict Mode: NO Nov 17 21:14:02 nospam snort[5612]: Allow Proxy Usage: NO Nov 17 21:14:02 nospam snort[5612]: Disable Alerting: NO Nov 17 21:14:02 nospam snort[5612]: Oversize Dir Length: 500 Nov 17 21:14:02 nospam snort[5612]: Only inspect URI: NO Nov 17 21:14:02 nospam snort[5612]: Ascii: YES alert: NO Nov 17 21:14:02 nospam snort[5612]: Double Decoding: YES alert: YES Nov 17 21:14:02 nospam snort[5612]: %U Encoding: YES alert: YES Nov 17 21:14:02 nospam snort[5612]: Bare Byte: YES alert: YES Nov 17 21:14:02 nospam snort[5612]: Base36: OFF Nov 17 21:14:02 nospam snort[5612]: UTF 8: OFF Nov 17 21:14:02 nospam snort[5612]: IIS Unicode: YES alert: YES Nov 17 21:14:02 nospam snort[5612]: Multiple Slash: YES alert: NO Nov 17 21:14:02 nospam snort[5612]: IIS Backslash: YES alert: NO Nov 17 21:14:02 nospam snort[5612]: Directory Traversal: YES alert: NO Nov 17 21:14:02 nospam snort[5612]: Web Root Traversal: YES alert: YES Nov 17 21:14:02 nospam snort[5612]: Apache WhiteSpace: YES alert: NO Nov 17 21:14:02 nospam snort[5612]: IIS Delimiter: YES alert: NO Nov 17 21:14:02 nospam snort[5612]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:14:02 nospam snort[5612]: Non-RFC Compliant Characters: NONE Nov 17 21:14:02 nospam snort[5612]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:14:02 nospam snort[5612]: rpc_decode arguments: Nov 17 21:14:02 nospam snort[5612]: Ports to decode RPC on: 111 32771 Nov 17 21:14:02 nospam snort[5612]: alert_fragments: INACTIVE Nov 17 21:14:02 nospam snort[5612]: alert_large_fragments: ACTIVE Nov 17 21:14:02 nospam snort[5612]: alert_incomplete: ACTIVE Nov 17 21:14:02 nospam snort[5612]: alert_multiple_requests: ACTIVE Nov 17 21:14:02 nospam snort[5612]: Portscan Detection Config: Nov 17 21:14:02 nospam snort[5612]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:14:02 nospam snort[5612]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:14:02 nospam snort[5612]: Sensitivity Level: Low Nov 17 21:14:02 nospam snort[5612]: Memcap (in bytes): 10000000 Nov 17 21:14:02 nospam snort[5612]: Number of Nodes: 26109 Nov 17 21:14:02 nospam snort[5612]: Nov 17 21:14:02 nospam snort[5612]: FATAL ERROR: Unable to open rules file: /etc/snort/rules/community-games.rules or /etc/snort//etc/snort/rules/community-games.rules Nov 17 21:14:57 nospam snort[5707]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:14:57 nospam snort[5707]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:14:57 nospam snort[5707]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:14:57 nospam snort[5707]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:14:57 nospam snort[5707]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:14:57 nospam snort[5707]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:14:57 nospam snort[5707]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:14:57 nospam snort[5707]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:14:57 nospam snort[5707]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:14:57 nospam snort[5707]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:14:57 nospam snort[5707]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:14:57 nospam snort[5707]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:14:57 nospam snort[5707]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:14:57 nospam snort[5707]: Var 'HOME_NET' redefined Nov 17 21:14:57 nospam snort[5707]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:14:57 nospam snort[5707]: , value = any Nov 17 21:14:57 nospam snort[5707]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:14:57 nospam snort[5707]: , value = [192.168.1.0/24] Nov 17 21:14:57 nospam snort[5707]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:14:57 nospam snort[5707]: , value = [192.168.1.0/24] Nov 17 21:14:57 nospam snort[5707]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:14:57 nospam snort[5707]: , value = [192.168.1.0/24] Nov 17 21:14:57 nospam snort[5707]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:14:57 nospam snort[5707]: , value = [192.168.1.0/24] Nov 17 21:14:57 nospam snort[5707]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:14:57 nospam snort[5707]: , value = [192.168.1.0/24] Nov 17 21:14:57 nospam snort[5707]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:14:57 nospam snort[5707]: , value = [192.168.1.0/24] Nov 17 21:14:57 nospam snort[5707]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:14:57 nospam snort[5707]: , value = 80 Nov 17 21:14:57 nospam snort[5707]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:14:57 nospam snort[5707]: , value = !80 Nov 17 21:14:57 nospam snort[5707]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:14:57 nospam snort[5707]: , value = 1521 Nov 17 21:14:57 nospam snort[5707]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:14:57 nospam snort[5707]: Nov 17 21:14:57 nospam snort[5707]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:14:57 nospam snort[5707]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:14:57 nospam snort[5707]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:14:57 nospam snort[5707]: , value = /etc/snort/rules Nov 17 21:14:57 nospam snort[5707]: ,-----------[Flow Config]---------------------- Nov 17 21:14:57 nospam snort[5707]: | Stats Interval: 0 Nov 17 21:14:57 nospam snort[5707]: | Hash Method: 2 Nov 17 21:14:57 nospam snort[5707]: | Memcap: 10485760 Nov 17 21:14:57 nospam snort[5707]: | Rows : 4099 Nov 17 21:14:57 nospam snort[5707]: | Overhead Bytes: 32800(%0.31) Nov 17 21:14:57 nospam snort[5707]: `---------------------------------------------- Nov 17 21:14:57 nospam snort[5707]: Frag3 global config: Nov 17 21:14:57 nospam snort[5707]: Max frags: 65536 Nov 17 21:14:57 nospam snort[5707]: Fragment memory cap: 4194304 bytes Nov 17 21:14:57 nospam snort[5707]: Frag3 engine config: Nov 17 21:14:57 nospam snort[5707]: Target-based policy: FIRST Nov 17 21:14:57 nospam snort[5707]: Fragment timeout: 60 seconds Nov 17 21:14:57 nospam snort[5707]: Fragment min_ttl: 1 Nov 17 21:14:57 nospam snort[5707]: Fragment ttl_limit: 5 Nov 17 21:14:57 nospam snort[5707]: Fragment Problems: 1 Nov 17 21:14:57 nospam snort[5707]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:14:57 nospam snort[5707]: Stream5 global config: Nov 17 21:14:57 nospam snort[5707]: Track TCP sessions: ACTIVE Nov 17 21:14:57 nospam snort[5707]: Max TCP sessions: 8192 Nov 17 21:14:57 nospam snort[5707]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:14:57 nospam snort[5707]: Track UDP sessions: INACTIVE Nov 17 21:14:57 nospam snort[5707]: Track ICMP sessions: INACTIVE Nov 17 21:14:57 nospam snort[5707]: Stream5 TCP Policy config: Nov 17 21:14:57 nospam snort[5707]: Reassembly Policy: FIRST Nov 17 21:14:57 nospam snort[5707]: Timeout: 30 seconds Nov 17 21:14:57 nospam snort[5707]: Min ttl: 1 Nov 17 21:14:57 nospam snort[5707]: Options: Nov 17 21:14:57 nospam snort[5707]: Static Flushpoint Sizes: YES Nov 17 21:14:57 nospam snort[5707]: Reassembly Ports: Nov 17 21:14:57 nospam snort[5707]: 21 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 23 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 25 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 42 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 53 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 80 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 110 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 111 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 135 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 136 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 137 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 139 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 143 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 445 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 513 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 1433 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 1521 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: 3306 client (Footprint) Nov 17 21:14:57 nospam snort[5707]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:14:57 nospam snort[5707]: HttpInspect Config: Nov 17 21:14:57 nospam snort[5707]: GLOBAL CONFIG Nov 17 21:14:57 nospam snort[5707]: Max Pipeline Requests: 0 Nov 17 21:14:57 nospam snort[5707]: Inspection Type: STATELESS Nov 17 21:14:57 nospam snort[5707]: Detect Proxy Usage: NO Nov 17 21:14:57 nospam snort[5707]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:14:57 nospam snort[5707]: IIS Unicode Map Codepage: 1252 Nov 17 21:14:57 nospam snort[5707]: DEFAULT SERVER CONFIG: Nov 17 21:14:57 nospam snort[5707]: Server profile: All Nov 17 21:14:57 nospam snort[5707]: Ports: 80 8080 8180 Nov 17 21:14:57 nospam snort[5707]: Flow Depth: 300 Nov 17 21:14:57 nospam snort[5707]: Max Chunk Length: 500000 Nov 17 21:14:57 nospam snort[5707]: Inspect Pipeline Requests: YES Nov 17 21:14:57 nospam snort[5707]: URI Discovery Strict Mode: NO Nov 17 21:14:57 nospam snort[5707]: Allow Proxy Usage: NO Nov 17 21:14:57 nospam snort[5707]: Disable Alerting: NO Nov 17 21:14:57 nospam snort[5707]: Oversize Dir Length: 500 Nov 17 21:14:57 nospam snort[5707]: Only inspect URI: NO Nov 17 21:14:57 nospam snort[5707]: Ascii: YES alert: NO Nov 17 21:14:57 nospam snort[5707]: Double Decoding: YES alert: YES Nov 17 21:14:57 nospam snort[5707]: %U Encoding: YES alert: YES Nov 17 21:14:57 nospam snort[5707]: Bare Byte: YES alert: YES Nov 17 21:14:57 nospam snort[5707]: Base36: OFF Nov 17 21:14:57 nospam snort[5707]: UTF 8: OFF Nov 17 21:14:57 nospam snort[5707]: IIS Unicode: YES alert: YES Nov 17 21:14:57 nospam snort[5707]: Multiple Slash: YES alert: NO Nov 17 21:14:57 nospam snort[5707]: IIS Backslash: YES alert: NO Nov 17 21:14:57 nospam snort[5707]: Directory Traversal: YES alert: NO Nov 17 21:14:57 nospam snort[5707]: Web Root Traversal: YES alert: YES Nov 17 21:14:57 nospam snort[5707]: Apache WhiteSpace: YES alert: NO Nov 17 21:14:57 nospam snort[5707]: IIS Delimiter: YES alert: NO Nov 17 21:14:57 nospam snort[5707]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:14:57 nospam snort[5707]: Non-RFC Compliant Characters: NONE Nov 17 21:14:57 nospam snort[5707]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:14:57 nospam snort[5707]: rpc_decode arguments: Nov 17 21:14:57 nospam snort[5707]: Ports to decode RPC on: 111 32771 Nov 17 21:14:57 nospam snort[5707]: alert_fragments: INACTIVE Nov 17 21:14:57 nospam snort[5707]: alert_large_fragments: ACTIVE Nov 17 21:14:57 nospam snort[5707]: alert_incomplete: ACTIVE Nov 17 21:14:57 nospam snort[5707]: alert_multiple_requests: ACTIVE Nov 17 21:14:57 nospam snort[5707]: Portscan Detection Config: Nov 17 21:14:57 nospam snort[5707]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:14:57 nospam snort[5707]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:14:57 nospam snort[5707]: Sensitivity Level: Low Nov 17 21:14:57 nospam snort[5707]: Memcap (in bytes): 10000000 Nov 17 21:14:57 nospam snort[5707]: Number of Nodes: 26109 Nov 17 21:14:57 nospam snort[5707]: Nov 17 21:14:57 nospam snort[5707]: FATAL ERROR: Unable to open rules file: /etc/snort/rules/community-games.rules or /etc/snort//etc/snort/rules/community-games.rules Nov 17 21:17:42 nospam snort[5951]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:17:42 nospam snort[5951]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:17:42 nospam snort[5951]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:17:42 nospam snort[5951]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:17:42 nospam snort[5951]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:17:42 nospam snort[5951]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:17:42 nospam snort[5951]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:17:42 nospam snort[5951]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:17:42 nospam snort[5951]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:17:42 nospam snort[5951]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:17:42 nospam snort[5951]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:17:42 nospam snort[5951]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:17:42 nospam snort[5951]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:17:42 nospam snort[5951]: Var 'HOME_NET' redefined Nov 17 21:17:42 nospam snort[5951]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:17:42 nospam snort[5951]: , value = any Nov 17 21:17:42 nospam snort[5951]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:17:42 nospam snort[5951]: , value = [192.168.1.0/24] Nov 17 21:17:42 nospam snort[5951]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:17:42 nospam snort[5951]: , value = [192.168.1.0/24] Nov 17 21:17:42 nospam snort[5951]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:17:42 nospam snort[5951]: , value = [192.168.1.0/24] Nov 17 21:17:42 nospam snort[5951]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:17:42 nospam snort[5951]: , value = [192.168.1.0/24] Nov 17 21:17:42 nospam snort[5951]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:17:42 nospam snort[5951]: , value = [192.168.1.0/24] Nov 17 21:17:42 nospam snort[5951]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:17:42 nospam snort[5951]: , value = [192.168.1.0/24] Nov 17 21:17:42 nospam snort[5951]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:17:42 nospam snort[5951]: , value = 80 Nov 17 21:17:42 nospam snort[5951]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:17:42 nospam snort[5951]: , value = !80 Nov 17 21:17:42 nospam snort[5951]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:17:42 nospam snort[5951]: , value = 1521 Nov 17 21:17:42 nospam snort[5951]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:17:42 nospam snort[5951]: Nov 17 21:17:42 nospam snort[5951]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:17:42 nospam snort[5951]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:17:42 nospam snort[5951]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:17:42 nospam snort[5951]: , value = /etc/snort/rules Nov 17 21:17:42 nospam snort[5951]: ,-----------[Flow Config]---------------------- Nov 17 21:17:42 nospam snort[5951]: | Stats Interval: 0 Nov 17 21:17:42 nospam snort[5951]: | Hash Method: 2 Nov 17 21:17:42 nospam snort[5951]: | Memcap: 10485760 Nov 17 21:17:42 nospam snort[5951]: | Rows : 4099 Nov 17 21:17:42 nospam snort[5951]: | Overhead Bytes: 32800(%0.31) Nov 17 21:17:42 nospam snort[5951]: `---------------------------------------------- Nov 17 21:17:42 nospam snort[5951]: Frag3 global config: Nov 17 21:17:42 nospam snort[5951]: Max frags: 65536 Nov 17 21:17:42 nospam snort[5951]: Fragment memory cap: 4194304 bytes Nov 17 21:17:42 nospam snort[5951]: Frag3 engine config: Nov 17 21:17:42 nospam snort[5951]: Target-based policy: FIRST Nov 17 21:17:42 nospam snort[5951]: Fragment timeout: 60 seconds Nov 17 21:17:42 nospam snort[5951]: Fragment min_ttl: 1 Nov 17 21:17:42 nospam snort[5951]: Fragment ttl_limit: 5 Nov 17 21:17:42 nospam snort[5951]: Fragment Problems: 1 Nov 17 21:17:42 nospam snort[5951]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:17:42 nospam snort[5951]: Stream5 global config: Nov 17 21:17:42 nospam snort[5951]: Track TCP sessions: ACTIVE Nov 17 21:17:42 nospam snort[5951]: Max TCP sessions: 8192 Nov 17 21:17:42 nospam snort[5951]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:17:42 nospam snort[5951]: Track UDP sessions: INACTIVE Nov 17 21:17:42 nospam snort[5951]: Track ICMP sessions: INACTIVE Nov 17 21:17:42 nospam snort[5951]: Stream5 TCP Policy config: Nov 17 21:17:42 nospam snort[5951]: Reassembly Policy: FIRST Nov 17 21:17:42 nospam snort[5951]: Timeout: 30 seconds Nov 17 21:17:42 nospam snort[5951]: Min ttl: 1 Nov 17 21:17:42 nospam snort[5951]: Options: Nov 17 21:17:42 nospam snort[5951]: Static Flushpoint Sizes: YES Nov 17 21:17:42 nospam snort[5951]: Reassembly Ports: Nov 17 21:17:42 nospam snort[5951]: 21 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 23 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 25 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 42 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 53 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 80 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 110 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 111 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 135 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 136 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 137 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 139 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 143 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 445 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 513 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 1433 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 1521 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: 3306 client (Footprint) Nov 17 21:17:42 nospam snort[5951]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:17:42 nospam snort[5951]: HttpInspect Config: Nov 17 21:17:42 nospam snort[5951]: GLOBAL CONFIG Nov 17 21:17:42 nospam snort[5951]: Max Pipeline Requests: 0 Nov 17 21:17:42 nospam snort[5951]: Inspection Type: STATELESS Nov 17 21:17:42 nospam snort[5951]: Detect Proxy Usage: NO Nov 17 21:17:42 nospam snort[5951]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:17:42 nospam snort[5951]: IIS Unicode Map Codepage: 1252 Nov 17 21:17:42 nospam snort[5951]: DEFAULT SERVER CONFIG: Nov 17 21:17:42 nospam snort[5951]: Server profile: All Nov 17 21:17:42 nospam snort[5951]: Ports: 80 8080 8180 Nov 17 21:17:42 nospam snort[5951]: Flow Depth: 300 Nov 17 21:17:42 nospam snort[5951]: Max Chunk Length: 500000 Nov 17 21:17:42 nospam snort[5951]: Inspect Pipeline Requests: YES Nov 17 21:17:42 nospam snort[5951]: URI Discovery Strict Mode: NO Nov 17 21:17:42 nospam snort[5951]: Allow Proxy Usage: NO Nov 17 21:17:42 nospam snort[5951]: Disable Alerting: NO Nov 17 21:17:42 nospam snort[5951]: Oversize Dir Length: 500 Nov 17 21:17:42 nospam snort[5951]: Only inspect URI: NO Nov 17 21:17:42 nospam snort[5951]: Ascii: YES alert: NO Nov 17 21:17:42 nospam snort[5951]: Double Decoding: YES alert: YES Nov 17 21:17:42 nospam snort[5951]: %U Encoding: YES alert: YES Nov 17 21:17:42 nospam snort[5951]: Bare Byte: YES alert: YES Nov 17 21:17:42 nospam snort[5951]: Base36: OFF Nov 17 21:17:42 nospam snort[5951]: UTF 8: OFF Nov 17 21:17:42 nospam snort[5951]: IIS Unicode: YES alert: YES Nov 17 21:17:42 nospam snort[5951]: Multiple Slash: YES alert: NO Nov 17 21:17:42 nospam snort[5951]: IIS Backslash: YES alert: NO Nov 17 21:17:42 nospam snort[5951]: Directory Traversal: YES alert: NO Nov 17 21:17:42 nospam snort[5951]: Web Root Traversal: YES alert: YES Nov 17 21:17:42 nospam snort[5951]: Apache WhiteSpace: YES alert: NO Nov 17 21:17:42 nospam snort[5951]: IIS Delimiter: YES alert: NO Nov 17 21:17:42 nospam snort[5951]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:17:42 nospam snort[5951]: Non-RFC Compliant Characters: NONE Nov 17 21:17:42 nospam snort[5951]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:17:42 nospam snort[5951]: rpc_decode arguments: Nov 17 21:17:42 nospam snort[5951]: Ports to decode RPC on: 111 32771 Nov 17 21:17:42 nospam snort[5951]: alert_fragments: INACTIVE Nov 17 21:17:42 nospam snort[5951]: alert_large_fragments: ACTIVE Nov 17 21:17:42 nospam snort[5951]: alert_incomplete: ACTIVE Nov 17 21:17:42 nospam snort[5951]: alert_multiple_requests: ACTIVE Nov 17 21:17:42 nospam snort[5951]: Portscan Detection Config: Nov 17 21:17:42 nospam snort[5951]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:17:42 nospam snort[5951]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:17:42 nospam snort[5951]: Sensitivity Level: Low Nov 17 21:17:42 nospam snort[5951]: Memcap (in bytes): 10000000 Nov 17 21:17:42 nospam snort[5951]: Number of Nodes: 26109 Nov 17 21:17:42 nospam snort[5951]: Nov 17 21:17:42 nospam snort[5951]: Tagged Packet Limit: 256 Nov 17 21:17:42 nospam snort[5951]: Nov 17 21:17:42 nospam snort[5951]: +-----------------------[thresholding-config]---------------------------------- Nov 17 21:17:42 nospam snort[5951]: | memory-cap : 1048576 bytes Nov 17 21:17:42 nospam snort[5951]: +-----------------------[thresholding-global]---------------------------------- Nov 17 21:17:42 nospam snort[5951]: | none Nov 17 21:17:42 nospam snort[5951]: +-----------------------[thresholding-local]----------------------------------- Nov 17 21:17:42 nospam snort[5951]: | none Nov 17 21:17:42 nospam snort[5951]: +-----------------------[suppression]------------------------------------------ Nov 17 21:17:42 nospam snort[5951]: | none Nov 17 21:17:42 nospam snort[5951]: ------------------------------------------------------------------------------- Nov 17 21:17:42 nospam snort[5951]: Rule application order: activation->dynamic->pass->drop->alert->log Nov 17 21:17:42 nospam snort[5951]: Log directory = /var/log/snort Nov 17 21:17:42 nospam snort[5951]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Nov 17 21:17:42 nospam snort[5951]: done Nov 17 21:17:42 nospam snort[5951]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Nov 17 21:17:42 nospam snort[5951]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 17 21:17:42 nospam snort[5951]: done Nov 17 21:17:42 nospam snort[5951]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 17 21:17:42 nospam snort[5951]: done Nov 17 21:17:42 nospam snort[5951]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... Nov 17 21:17:42 nospam snort[5951]: done Nov 17 21:17:42 nospam snort[5951]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 17 21:17:42 nospam snort[5951]: done Nov 17 21:17:42 nospam snort[5951]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Nov 17 21:17:42 nospam snort[5951]: done Nov 17 21:17:42 nospam snort[5951]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Nov 17 21:17:42 nospam snort[5951]: FTPTelnet Config: Nov 17 21:17:42 nospam snort[5951]: GLOBAL CONFIG Nov 17 21:17:42 nospam snort[5951]: Inspection Type: stateful Nov 17 21:17:42 nospam snort[5951]: Check for Encrypted Traffic: YES alert: YES Nov 17 21:17:42 nospam snort[5951]: Continue to check encrypted data: NO Nov 17 21:17:42 nospam snort[5951]: TELNET CONFIG: Nov 17 21:17:42 nospam snort[5951]: Ports: 23 Nov 17 21:17:42 nospam snort[5951]: Are You There Threshold: 200 Nov 17 21:17:42 nospam snort[5951]: Normalize: YES Nov 17 21:17:42 nospam snort[5951]: Detect Anomalies: NO Nov 17 21:17:42 nospam snort[5951]: FTP CONFIG: Nov 17 21:17:42 nospam snort[5951]: FTP Server: default Nov 17 21:17:42 nospam snort[5951]: Ports: 21 Nov 17 21:17:42 nospam snort[5951]: Check for Telnet Cmds: YES alert: YES Nov 17 21:17:42 nospam snort[5951]: Identify open data channels: YES Nov 17 21:17:42 nospam snort[5951]: FTP Client: default Nov 17 21:17:42 nospam snort[5951]: Check for Bounce Attacks: YES alert: YES Nov 17 21:17:42 nospam snort[5951]: Check for Telnet Cmds: YES alert: YES Nov 17 21:17:42 nospam snort[5951]: Max Response Length: 256 Nov 17 21:17:42 nospam snort[5951]: SMTP Config: Nov 17 21:17:42 nospam snort[5951]: Ports: Nov 17 21:17:42 nospam snort[5951]: 25 Nov 17 21:17:42 nospam snort[5951]: Nov 17 21:17:42 nospam snort[5951]: Inspection Type: STATEFUL Nov 17 21:17:42 nospam snort[5951]: Normalize Spaces: YES Nov 17 21:17:42 nospam snort[5951]: Ignore Data: NO Nov 17 21:17:42 nospam snort[5951]: Ignore TLS Data: NO Nov 17 21:17:42 nospam snort[5951]: Ignore Alerts: NO Nov 17 21:17:42 nospam snort[5951]: Max Command Length: 0 Nov 17 21:17:42 nospam snort[5951]: Max Header Line Length: 0 Nov 17 21:17:42 nospam snort[5951]: Max Response Line Length: 0 Nov 17 21:17:42 nospam snort[5951]: X-Link2State Alert: YES Nov 17 21:17:42 nospam snort[5951]: Drop on X-Link2State Alert: NO Nov 17 21:17:42 nospam snort[5951]: DCE/RPC Decoder config: Nov 17 21:17:42 nospam snort[5951]: Autodetect ports ENABLED Nov 17 21:17:42 nospam snort[5951]: SMB fragmentation ENABLED Nov 17 21:17:42 nospam snort[5951]: DCE/RPC fragmentation ENABLED Nov 17 21:17:42 nospam snort[5951]: Max Frag Size: 3000 bytes Nov 17 21:17:42 nospam snort[5951]: Memcap: 100000 KB Nov 17 21:17:42 nospam snort[5951]: Alert if memcap exceeded DISABLED Nov 17 21:17:42 nospam snort[5951]: Nov 17 21:17:42 nospam snort[5951]: DNS config: Nov 17 21:17:42 nospam snort[5951]: DNS Client rdata txt Overflow Alert: ACTIVE Nov 17 21:17:42 nospam snort[5951]: Obsolete DNS RR Types Alert: INACTIVE Nov 17 21:17:42 nospam snort[5951]: Experimental DNS RR Types Alert: INACTIVE Nov 17 21:17:42 nospam snort[5951]: Ports: Nov 17 21:17:42 nospam snort[5951]: 53 Nov 17 21:17:42 nospam snort[5951]: Nov 17 21:17:43 nospam snort[5951]: Warning: flowbits key 'community_uri.size.1050' is set but not ever checked. Nov 17 21:17:43 nospam snort[5951]: 295 out of 512 flowbits in use. Nov 17 21:17:43 nospam snort[5951]: Initializing daemon mode Nov 17 21:17:43 nospam snort[5953]: PID path stat checked out ok, PID path set to /var/run/ Nov 17 21:17:43 nospam snort[5953]: Writing PID "5953" to file "/var/run//snort_eth0.pid" Nov 17 21:17:43 nospam snort[5951]: Daemon parent exiting Nov 17 21:17:43 nospam snort[5953]: Daemon initialized, signaled parent pid: 5951 Nov 17 21:18:18 nospam snort[6036]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:18:18 nospam snort[6036]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:18:18 nospam snort[6036]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:18:18 nospam snort[6036]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:18:18 nospam snort[6036]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:18:18 nospam snort[6036]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:18:18 nospam snort[6036]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:18:18 nospam snort[6036]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:18:18 nospam snort[6036]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:18:18 nospam snort[6036]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:18:18 nospam snort[6036]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:18:18 nospam snort[6036]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:18:18 nospam snort[6036]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:18:18 nospam snort[6036]: Var 'HOME_NET' redefined Nov 17 21:18:18 nospam snort[6036]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:18:18 nospam snort[6036]: , value = any Nov 17 21:18:18 nospam snort[6036]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:18:18 nospam snort[6036]: , value = [192.168.1.0/24] Nov 17 21:18:18 nospam snort[6036]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:18:18 nospam snort[6036]: , value = [192.168.1.0/24] Nov 17 21:18:18 nospam snort[6036]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:18:18 nospam snort[6036]: , value = [192.168.1.0/24] Nov 17 21:18:18 nospam snort[6036]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:18:18 nospam snort[6036]: , value = [192.168.1.0/24] Nov 17 21:18:18 nospam snort[6036]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:18:18 nospam snort[6036]: , value = [192.168.1.0/24] Nov 17 21:18:18 nospam snort[6036]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:18:18 nospam snort[6036]: , value = [192.168.1.0/24] Nov 17 21:18:18 nospam snort[6036]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:18:18 nospam snort[6036]: , value = 80 Nov 17 21:18:18 nospam snort[6036]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:18:18 nospam snort[6036]: , value = !80 Nov 17 21:18:18 nospam snort[6036]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:18:18 nospam snort[6036]: , value = 1521 Nov 17 21:18:18 nospam snort[6036]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:18:18 nospam snort[6036]: Nov 17 21:18:18 nospam snort[6036]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:18:18 nospam snort[6036]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:18:18 nospam snort[6036]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:18:18 nospam snort[6036]: , value = /etc/snort/rules Nov 17 21:18:18 nospam snort[6036]: ,-----------[Flow Config]---------------------- Nov 17 21:18:18 nospam snort[6036]: | Stats Interval: 0 Nov 17 21:18:18 nospam snort[6036]: | Hash Method: 2 Nov 17 21:18:18 nospam snort[6036]: | Memcap: 10485760 Nov 17 21:18:18 nospam snort[6036]: | Rows : 4099 Nov 17 21:18:18 nospam snort[6036]: | Overhead Bytes: 32800(%0.31) Nov 17 21:18:18 nospam snort[6036]: `---------------------------------------------- Nov 17 21:18:18 nospam snort[6036]: Frag3 global config: Nov 17 21:18:18 nospam snort[6036]: Max frags: 65536 Nov 17 21:18:18 nospam snort[6036]: Fragment memory cap: 4194304 bytes Nov 17 21:18:18 nospam snort[6036]: Frag3 engine config: Nov 17 21:18:18 nospam snort[6036]: Target-based policy: FIRST Nov 17 21:18:18 nospam snort[6036]: Fragment timeout: 60 seconds Nov 17 21:18:18 nospam snort[6036]: Fragment min_ttl: 1 Nov 17 21:18:18 nospam snort[6036]: Fragment ttl_limit: 5 Nov 17 21:18:18 nospam snort[6036]: Fragment Problems: 1 Nov 17 21:18:18 nospam snort[6036]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:18:18 nospam snort[6036]: Stream5 global config: Nov 17 21:18:18 nospam snort[6036]: Track TCP sessions: ACTIVE Nov 17 21:18:18 nospam snort[6036]: Max TCP sessions: 8192 Nov 17 21:18:18 nospam snort[6036]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:18:18 nospam snort[6036]: Track UDP sessions: INACTIVE Nov 17 21:18:18 nospam snort[6036]: Track ICMP sessions: INACTIVE Nov 17 21:18:18 nospam snort[6036]: Stream5 TCP Policy config: Nov 17 21:18:18 nospam snort[6036]: Reassembly Policy: FIRST Nov 17 21:18:18 nospam snort[6036]: Timeout: 30 seconds Nov 17 21:18:18 nospam snort[6036]: Min ttl: 1 Nov 17 21:18:18 nospam snort[6036]: Options: Nov 17 21:18:18 nospam snort[6036]: Static Flushpoint Sizes: YES Nov 17 21:18:18 nospam snort[6036]: Reassembly Ports: Nov 17 21:18:18 nospam snort[6036]: 21 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 23 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 25 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 42 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 53 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 80 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 110 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 111 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 135 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 136 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 137 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 139 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 143 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 445 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 513 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 1433 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 1521 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: 3306 client (Footprint) Nov 17 21:18:18 nospam snort[6036]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:18:18 nospam snort[6036]: HttpInspect Config: Nov 17 21:18:18 nospam snort[6036]: GLOBAL CONFIG Nov 17 21:18:18 nospam snort[6036]: Max Pipeline Requests: 0 Nov 17 21:18:18 nospam snort[6036]: Inspection Type: STATELESS Nov 17 21:18:18 nospam snort[6036]: Detect Proxy Usage: NO Nov 17 21:18:18 nospam snort[6036]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:18:18 nospam snort[6036]: IIS Unicode Map Codepage: 1252 Nov 17 21:18:18 nospam snort[6036]: DEFAULT SERVER CONFIG: Nov 17 21:18:18 nospam snort[6036]: Server profile: All Nov 17 21:18:18 nospam snort[6036]: Ports: 80 8080 8180 Nov 17 21:18:18 nospam snort[6036]: Flow Depth: 300 Nov 17 21:18:18 nospam snort[6036]: Max Chunk Length: 500000 Nov 17 21:18:18 nospam snort[6036]: Inspect Pipeline Requests: YES Nov 17 21:18:18 nospam snort[6036]: URI Discovery Strict Mode: NO Nov 17 21:18:18 nospam snort[6036]: Allow Proxy Usage: NO Nov 17 21:18:18 nospam snort[6036]: Disable Alerting: NO Nov 17 21:18:18 nospam snort[6036]: Oversize Dir Length: 500 Nov 17 21:18:18 nospam snort[6036]: Only inspect URI: NO Nov 17 21:18:18 nospam snort[6036]: Ascii: YES alert: NO Nov 17 21:18:18 nospam snort[6036]: Double Decoding: YES alert: YES Nov 17 21:18:18 nospam snort[6036]: %U Encoding: YES alert: YES Nov 17 21:18:18 nospam snort[6036]: Bare Byte: YES alert: YES Nov 17 21:18:18 nospam snort[6036]: Base36: OFF Nov 17 21:18:18 nospam snort[6036]: UTF 8: OFF Nov 17 21:18:18 nospam snort[6036]: IIS Unicode: YES alert: YES Nov 17 21:18:18 nospam snort[6036]: Multiple Slash: YES alert: NO Nov 17 21:18:18 nospam snort[6036]: IIS Backslash: YES alert: NO Nov 17 21:18:18 nospam snort[6036]: Directory Traversal: YES alert: NO Nov 17 21:18:18 nospam snort[6036]: Web Root Traversal: YES alert: YES Nov 17 21:18:18 nospam snort[6036]: Apache WhiteSpace: YES alert: NO Nov 17 21:18:18 nospam snort[6036]: IIS Delimiter: YES alert: NO Nov 17 21:18:18 nospam snort[6036]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:18:18 nospam snort[6036]: Non-RFC Compliant Characters: NONE Nov 17 21:18:18 nospam snort[6036]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:18:18 nospam snort[6036]: rpc_decode arguments: Nov 17 21:18:18 nospam snort[6036]: Ports to decode RPC on: 111 32771 Nov 17 21:18:18 nospam snort[6036]: alert_fragments: INACTIVE Nov 17 21:18:18 nospam snort[6036]: alert_large_fragments: ACTIVE Nov 17 21:18:18 nospam snort[6036]: alert_incomplete: ACTIVE Nov 17 21:18:18 nospam snort[6036]: alert_multiple_requests: ACTIVE Nov 17 21:18:18 nospam snort[6036]: Portscan Detection Config: Nov 17 21:18:18 nospam snort[6036]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:18:18 nospam snort[6036]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:18:18 nospam snort[6036]: Sensitivity Level: Low Nov 17 21:18:18 nospam snort[6036]: Memcap (in bytes): 10000000 Nov 17 21:18:18 nospam snort[6036]: Number of Nodes: 26109 Nov 17 21:18:18 nospam snort[6036]: Nov 17 21:18:18 nospam snort[6036]: Tagged Packet Limit: 256 Nov 17 21:18:18 nospam snort[6036]: Nov 17 21:18:18 nospam snort[6036]: +-----------------------[thresholding-config]---------------------------------- Nov 17 21:18:18 nospam snort[6036]: | memory-cap : 1048576 bytes Nov 17 21:18:18 nospam snort[6036]: +-----------------------[thresholding-global]---------------------------------- Nov 17 21:18:18 nospam snort[6036]: | none Nov 17 21:18:18 nospam snort[6036]: +-----------------------[thresholding-local]----------------------------------- Nov 17 21:18:18 nospam snort[6036]: | none Nov 17 21:18:18 nospam snort[6036]: +-----------------------[suppression]------------------------------------------ Nov 17 21:18:18 nospam snort[6036]: | none Nov 17 21:18:18 nospam snort[6036]: ------------------------------------------------------------------------------- Nov 17 21:18:18 nospam snort[6036]: Rule application order: activation->dynamic->pass->drop->alert->log Nov 17 21:18:18 nospam snort[6036]: Log directory = /var/log/snort Nov 17 21:18:18 nospam snort[6036]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Nov 17 21:18:18 nospam snort[6036]: done Nov 17 21:18:18 nospam snort[6036]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Nov 17 21:18:18 nospam snort[6036]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 17 21:18:18 nospam snort[6036]: done Nov 17 21:18:18 nospam snort[6036]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 17 21:18:18 nospam snort[6036]: done Nov 17 21:18:18 nospam snort[6036]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... Nov 17 21:18:18 nospam snort[6036]: done Nov 17 21:18:18 nospam snort[6036]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 17 21:18:18 nospam snort[6036]: done Nov 17 21:18:18 nospam snort[6036]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Nov 17 21:18:18 nospam snort[6036]: done Nov 17 21:18:18 nospam snort[6036]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Nov 17 21:18:18 nospam snort[6036]: FTPTelnet Config: Nov 17 21:18:18 nospam snort[6036]: GLOBAL CONFIG Nov 17 21:18:18 nospam snort[6036]: Inspection Type: stateful Nov 17 21:18:18 nospam snort[6036]: Check for Encrypted Traffic: YES alert: YES Nov 17 21:18:18 nospam snort[6036]: Continue to check encrypted data: NO Nov 17 21:18:18 nospam snort[6036]: TELNET CONFIG: Nov 17 21:18:18 nospam snort[6036]: Ports: 23 Nov 17 21:18:18 nospam snort[6036]: Are You There Threshold: 200 Nov 17 21:18:18 nospam snort[6036]: Normalize: YES Nov 17 21:18:18 nospam snort[6036]: Detect Anomalies: NO Nov 17 21:18:18 nospam snort[6036]: FTP CONFIG: Nov 17 21:18:18 nospam snort[6036]: FTP Server: default Nov 17 21:18:18 nospam snort[6036]: Ports: 21 Nov 17 21:18:18 nospam snort[6036]: Check for Telnet Cmds: YES alert: YES Nov 17 21:18:18 nospam snort[6036]: Identify open data channels: YES Nov 17 21:18:18 nospam snort[6036]: FTP Client: default Nov 17 21:18:18 nospam snort[6036]: Check for Bounce Attacks: YES alert: YES Nov 17 21:18:18 nospam snort[6036]: Check for Telnet Cmds: YES alert: YES Nov 17 21:18:18 nospam snort[6036]: Max Response Length: 256 Nov 17 21:18:18 nospam snort[6036]: SMTP Config: Nov 17 21:18:18 nospam snort[6036]: Ports: Nov 17 21:18:18 nospam snort[6036]: 25 Nov 17 21:18:18 nospam snort[6036]: Nov 17 21:18:18 nospam snort[6036]: Inspection Type: STATEFUL Nov 17 21:18:18 nospam snort[6036]: Normalize Spaces: YES Nov 17 21:18:18 nospam snort[6036]: Ignore Data: NO Nov 17 21:18:18 nospam snort[6036]: Ignore TLS Data: NO Nov 17 21:18:18 nospam snort[6036]: Ignore Alerts: NO Nov 17 21:18:18 nospam snort[6036]: Max Command Length: 0 Nov 17 21:18:18 nospam snort[6036]: Max Header Line Length: 0 Nov 17 21:18:18 nospam snort[6036]: Max Response Line Length: 0 Nov 17 21:18:18 nospam snort[6036]: X-Link2State Alert: YES Nov 17 21:18:18 nospam snort[6036]: Drop on X-Link2State Alert: NO Nov 17 21:18:18 nospam snort[6036]: DCE/RPC Decoder config: Nov 17 21:18:18 nospam snort[6036]: Autodetect ports ENABLED Nov 17 21:18:18 nospam snort[6036]: SMB fragmentation ENABLED Nov 17 21:18:18 nospam snort[6036]: DCE/RPC fragmentation ENABLED Nov 17 21:18:18 nospam snort[6036]: Max Frag Size: 3000 bytes Nov 17 21:18:18 nospam snort[6036]: Memcap: 100000 KB Nov 17 21:18:18 nospam snort[6036]: Alert if memcap exceeded DISABLED Nov 17 21:18:18 nospam snort[6036]: Nov 17 21:18:18 nospam snort[6036]: DNS config: Nov 17 21:18:18 nospam snort[6036]: DNS Client rdata txt Overflow Alert: ACTIVE Nov 17 21:18:18 nospam snort[6036]: Obsolete DNS RR Types Alert: INACTIVE Nov 17 21:18:18 nospam snort[6036]: Experimental DNS RR Types Alert: INACTIVE Nov 17 21:18:18 nospam snort[6036]: Ports: Nov 17 21:18:18 nospam snort[6036]: 53 Nov 17 21:18:18 nospam snort[6036]: Nov 17 21:18:19 nospam snort[6036]: Warning: flowbits key 'community_uri.size.1050' is set but not ever checked. Nov 17 21:18:19 nospam snort[6036]: 295 out of 512 flowbits in use. Nov 17 21:18:20 nospam snort[6036]: Initializing daemon mode Nov 17 21:18:20 nospam snort[6040]: PID path stat checked out ok, PID path set to /var/run/ Nov 17 21:18:20 nospam snort[6040]: Writing PID "6040" to file "/var/run//snort_eth0.pid" Nov 17 21:18:20 nospam snort[6040]: Daemon initialized, signaled parent pid: 6036 Nov 17 21:18:20 nospam snort[6036]: Daemon parent exiting Nov 17 21:21:13 nospam snort[6210]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:21:13 nospam snort[6210]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:21:13 nospam snort[6210]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:21:13 nospam snort[6210]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:21:13 nospam snort[6210]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:21:13 nospam snort[6210]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:21:13 nospam snort[6210]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:21:13 nospam snort[6210]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:21:13 nospam snort[6210]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:21:13 nospam snort[6210]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:21:13 nospam snort[6210]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:21:13 nospam snort[6210]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:21:13 nospam snort[6210]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:21:13 nospam snort[6210]: Var 'HOME_NET' redefined Nov 17 21:21:13 nospam snort[6210]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:21:13 nospam snort[6210]: , value = any Nov 17 21:21:13 nospam snort[6210]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:21:13 nospam snort[6210]: , value = [192.168.1.0/24] Nov 17 21:21:13 nospam snort[6210]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:21:13 nospam snort[6210]: , value = [192.168.1.0/24] Nov 17 21:21:13 nospam snort[6210]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:21:13 nospam snort[6210]: , value = [192.168.1.0/24] Nov 17 21:21:13 nospam snort[6210]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:21:13 nospam snort[6210]: , value = [192.168.1.0/24] Nov 17 21:21:13 nospam snort[6210]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:21:13 nospam snort[6210]: , value = [192.168.1.0/24] Nov 17 21:21:13 nospam snort[6210]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:21:13 nospam snort[6210]: , value = [192.168.1.0/24] Nov 17 21:21:13 nospam snort[6210]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:21:13 nospam snort[6210]: , value = 80 Nov 17 21:21:13 nospam snort[6210]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:21:13 nospam snort[6210]: , value = !80 Nov 17 21:21:13 nospam snort[6210]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:21:13 nospam snort[6210]: , value = 1521 Nov 17 21:21:13 nospam snort[6210]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:21:13 nospam snort[6210]: Nov 17 21:21:13 nospam snort[6210]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:21:13 nospam snort[6210]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:21:13 nospam snort[6210]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:21:13 nospam snort[6210]: , value = /etc/snort/rules Nov 17 21:21:13 nospam snort[6210]: ,-----------[Flow Config]---------------------- Nov 17 21:21:13 nospam snort[6210]: | Stats Interval: 0 Nov 17 21:21:13 nospam snort[6210]: | Hash Method: 2 Nov 17 21:21:13 nospam snort[6210]: | Memcap: 10485760 Nov 17 21:21:13 nospam snort[6210]: | Rows : 4099 Nov 17 21:21:13 nospam snort[6210]: | Overhead Bytes: 32800(%0.31) Nov 17 21:21:13 nospam snort[6210]: `---------------------------------------------- Nov 17 21:21:13 nospam snort[6210]: Frag3 global config: Nov 17 21:21:13 nospam snort[6210]: Max frags: 65536 Nov 17 21:21:13 nospam snort[6210]: Fragment memory cap: 4194304 bytes Nov 17 21:21:13 nospam snort[6210]: Frag3 engine config: Nov 17 21:21:13 nospam snort[6210]: Target-based policy: FIRST Nov 17 21:21:13 nospam snort[6210]: Fragment timeout: 60 seconds Nov 17 21:21:13 nospam snort[6210]: Fragment min_ttl: 1 Nov 17 21:21:13 nospam snort[6210]: Fragment ttl_limit: 5 Nov 17 21:21:13 nospam snort[6210]: Fragment Problems: 1 Nov 17 21:21:13 nospam snort[6210]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:21:13 nospam snort[6210]: Stream5 global config: Nov 17 21:21:13 nospam snort[6210]: Track TCP sessions: ACTIVE Nov 17 21:21:13 nospam snort[6210]: Max TCP sessions: 8192 Nov 17 21:21:13 nospam snort[6210]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:21:13 nospam snort[6210]: Track UDP sessions: INACTIVE Nov 17 21:21:13 nospam snort[6210]: Track ICMP sessions: INACTIVE Nov 17 21:21:13 nospam snort[6210]: Stream5 TCP Policy config: Nov 17 21:21:13 nospam snort[6210]: Reassembly Policy: FIRST Nov 17 21:21:13 nospam snort[6210]: Timeout: 30 seconds Nov 17 21:21:13 nospam snort[6210]: Min ttl: 1 Nov 17 21:21:13 nospam snort[6210]: Options: Nov 17 21:21:13 nospam snort[6210]: Static Flushpoint Sizes: YES Nov 17 21:21:13 nospam snort[6210]: Reassembly Ports: Nov 17 21:21:13 nospam snort[6210]: 21 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 23 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 25 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 42 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 53 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 80 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 110 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 111 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 135 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 136 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 137 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 139 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 143 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 445 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 513 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 1433 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 1521 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: 3306 client (Footprint) Nov 17 21:21:13 nospam snort[6210]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:21:13 nospam snort[6210]: HttpInspect Config: Nov 17 21:21:13 nospam snort[6210]: GLOBAL CONFIG Nov 17 21:21:13 nospam snort[6210]: Max Pipeline Requests: 0 Nov 17 21:21:13 nospam snort[6210]: Inspection Type: STATELESS Nov 17 21:21:13 nospam snort[6210]: Detect Proxy Usage: NO Nov 17 21:21:13 nospam snort[6210]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:21:13 nospam snort[6210]: IIS Unicode Map Codepage: 1252 Nov 17 21:21:13 nospam snort[6210]: DEFAULT SERVER CONFIG: Nov 17 21:21:13 nospam snort[6210]: Server profile: All Nov 17 21:21:13 nospam snort[6210]: Ports: 80 8080 8180 Nov 17 21:21:13 nospam snort[6210]: Flow Depth: 300 Nov 17 21:21:13 nospam snort[6210]: Max Chunk Length: 500000 Nov 17 21:21:13 nospam snort[6210]: Inspect Pipeline Requests: YES Nov 17 21:21:13 nospam snort[6210]: URI Discovery Strict Mode: NO Nov 17 21:21:13 nospam snort[6210]: Allow Proxy Usage: NO Nov 17 21:21:13 nospam snort[6210]: Disable Alerting: NO Nov 17 21:21:13 nospam snort[6210]: Oversize Dir Length: 500 Nov 17 21:21:13 nospam snort[6210]: Only inspect URI: NO Nov 17 21:21:13 nospam snort[6210]: Ascii: YES alert: NO Nov 17 21:21:13 nospam snort[6210]: Double Decoding: YES alert: YES Nov 17 21:21:13 nospam snort[6210]: %U Encoding: YES alert: YES Nov 17 21:21:13 nospam snort[6210]: Bare Byte: YES alert: YES Nov 17 21:21:13 nospam snort[6210]: Base36: OFF Nov 17 21:21:13 nospam snort[6210]: UTF 8: OFF Nov 17 21:21:13 nospam snort[6210]: IIS Unicode: YES alert: YES Nov 17 21:21:13 nospam snort[6210]: Multiple Slash: YES alert: NO Nov 17 21:21:13 nospam snort[6210]: IIS Backslash: YES alert: NO Nov 17 21:21:13 nospam snort[6210]: Directory Traversal: YES alert: NO Nov 17 21:21:13 nospam snort[6210]: Web Root Traversal: YES alert: YES Nov 17 21:21:13 nospam snort[6210]: Apache WhiteSpace: YES alert: NO Nov 17 21:21:13 nospam snort[6210]: IIS Delimiter: YES alert: NO Nov 17 21:21:13 nospam snort[6210]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:21:13 nospam snort[6210]: Non-RFC Compliant Characters: NONE Nov 17 21:21:13 nospam snort[6210]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:21:13 nospam snort[6210]: rpc_decode arguments: Nov 17 21:21:13 nospam snort[6210]: Ports to decode RPC on: 111 32771 Nov 17 21:21:13 nospam snort[6210]: alert_fragments: INACTIVE Nov 17 21:21:13 nospam snort[6210]: alert_large_fragments: ACTIVE Nov 17 21:21:13 nospam snort[6210]: alert_incomplete: ACTIVE Nov 17 21:21:13 nospam snort[6210]: alert_multiple_requests: ACTIVE Nov 17 21:21:13 nospam snort[6210]: Portscan Detection Config: Nov 17 21:21:13 nospam snort[6210]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:21:13 nospam snort[6210]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:21:13 nospam snort[6210]: Sensitivity Level: Low Nov 17 21:21:13 nospam snort[6210]: Memcap (in bytes): 10000000 Nov 17 21:21:13 nospam snort[6210]: Number of Nodes: 26109 Nov 17 21:21:13 nospam snort[6210]: Nov 17 21:21:14 nospam snort[6210]: Tagged Packet Limit: 256 Nov 17 21:21:14 nospam snort[6210]: Nov 17 21:21:14 nospam snort[6210]: +-----------------------[thresholding-config]---------------------------------- Nov 17 21:21:14 nospam snort[6210]: | memory-cap : 1048576 bytes Nov 17 21:21:14 nospam snort[6210]: +-----------------------[thresholding-global]---------------------------------- Nov 17 21:21:14 nospam snort[6210]: | none Nov 17 21:21:14 nospam snort[6210]: +-----------------------[thresholding-local]----------------------------------- Nov 17 21:21:14 nospam snort[6210]: | none Nov 17 21:21:14 nospam snort[6210]: +-----------------------[suppression]------------------------------------------ Nov 17 21:21:14 nospam snort[6210]: | none Nov 17 21:21:14 nospam snort[6210]: ------------------------------------------------------------------------------- Nov 17 21:21:14 nospam snort[6210]: Rule application order: activation->dynamic->pass->drop->alert->log Nov 17 21:21:14 nospam snort[6210]: Log directory = /var/log/snort Nov 17 21:21:14 nospam snort[6210]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Nov 17 21:21:14 nospam snort[6210]: done Nov 17 21:21:14 nospam snort[6210]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Nov 17 21:21:14 nospam snort[6210]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 17 21:21:14 nospam snort[6210]: done Nov 17 21:21:14 nospam snort[6210]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 17 21:21:14 nospam snort[6210]: done Nov 17 21:21:14 nospam snort[6210]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... Nov 17 21:21:14 nospam snort[6210]: done Nov 17 21:21:14 nospam snort[6210]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 17 21:21:14 nospam snort[6210]: done Nov 17 21:21:14 nospam snort[6210]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Nov 17 21:21:14 nospam snort[6210]: done Nov 17 21:21:14 nospam snort[6210]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Nov 17 21:21:14 nospam snort[6210]: FTPTelnet Config: Nov 17 21:21:14 nospam snort[6210]: GLOBAL CONFIG Nov 17 21:21:14 nospam snort[6210]: Inspection Type: stateful Nov 17 21:21:14 nospam snort[6210]: Check for Encrypted Traffic: YES alert: YES Nov 17 21:21:14 nospam snort[6210]: Continue to check encrypted data: NO Nov 17 21:21:14 nospam snort[6210]: TELNET CONFIG: Nov 17 21:21:14 nospam snort[6210]: Ports: 23 Nov 17 21:21:14 nospam snort[6210]: Are You There Threshold: 200 Nov 17 21:21:14 nospam snort[6210]: Normalize: YES Nov 17 21:21:14 nospam snort[6210]: Detect Anomalies: NO Nov 17 21:21:14 nospam snort[6210]: FTP CONFIG: Nov 17 21:21:14 nospam snort[6210]: FTP Server: default Nov 17 21:21:14 nospam snort[6210]: Ports: 21 Nov 17 21:21:14 nospam snort[6210]: Check for Telnet Cmds: YES alert: YES Nov 17 21:21:14 nospam snort[6210]: Identify open data channels: YES Nov 17 21:21:14 nospam snort[6210]: FTP Client: default Nov 17 21:21:14 nospam snort[6210]: Check for Bounce Attacks: YES alert: YES Nov 17 21:21:14 nospam snort[6210]: Check for Telnet Cmds: YES alert: YES Nov 17 21:21:14 nospam snort[6210]: Max Response Length: 256 Nov 17 21:21:14 nospam snort[6210]: SMTP Config: Nov 17 21:21:14 nospam snort[6210]: Ports: Nov 17 21:21:14 nospam snort[6210]: 25 Nov 17 21:21:14 nospam snort[6210]: Nov 17 21:21:14 nospam snort[6210]: Inspection Type: STATEFUL Nov 17 21:21:14 nospam snort[6210]: Normalize Spaces: YES Nov 17 21:21:14 nospam snort[6210]: Ignore Data: NO Nov 17 21:21:14 nospam snort[6210]: Ignore TLS Data: NO Nov 17 21:21:14 nospam snort[6210]: Ignore Alerts: NO Nov 17 21:21:14 nospam snort[6210]: Max Command Length: 0 Nov 17 21:21:14 nospam snort[6210]: Max Header Line Length: 0 Nov 17 21:21:14 nospam snort[6210]: Max Response Line Length: 0 Nov 17 21:21:14 nospam snort[6210]: X-Link2State Alert: YES Nov 17 21:21:14 nospam snort[6210]: Drop on X-Link2State Alert: NO Nov 17 21:21:14 nospam snort[6210]: DCE/RPC Decoder config: Nov 17 21:21:14 nospam snort[6210]: Autodetect ports ENABLED Nov 17 21:21:14 nospam snort[6210]: SMB fragmentation ENABLED Nov 17 21:21:14 nospam snort[6210]: DCE/RPC fragmentation ENABLED Nov 17 21:21:14 nospam snort[6210]: Max Frag Size: 3000 bytes Nov 17 21:21:14 nospam snort[6210]: Memcap: 100000 KB Nov 17 21:21:14 nospam snort[6210]: Alert if memcap exceeded DISABLED Nov 17 21:21:14 nospam snort[6210]: Nov 17 21:21:14 nospam snort[6210]: DNS config: Nov 17 21:21:14 nospam snort[6210]: DNS Client rdata txt Overflow Alert: ACTIVE Nov 17 21:21:14 nospam snort[6210]: Obsolete DNS RR Types Alert: INACTIVE Nov 17 21:21:14 nospam snort[6210]: Experimental DNS RR Types Alert: INACTIVE Nov 17 21:21:14 nospam snort[6210]: Ports: Nov 17 21:21:14 nospam snort[6210]: 53 Nov 17 21:21:14 nospam snort[6210]: Nov 17 21:21:15 nospam snort[6210]: Warning: flowbits key 'community_uri.size.1050' is set but not ever checked. Nov 17 21:21:15 nospam snort[6210]: 296 out of 512 flowbits in use. Nov 17 21:21:15 nospam snort[6210]: Initializing daemon mode Nov 17 21:21:15 nospam snort[6211]: PID path stat checked out ok, PID path set to /var/run/ Nov 17 21:21:15 nospam snort[6211]: Writing PID "6211" to file "/var/run//snort_eth0.pid" Nov 17 21:21:15 nospam snort[6211]: Daemon initialized, signaled parent pid: 6210 Nov 17 21:21:15 nospam snort[6210]: Daemon parent exiting Nov 17 21:22:26 nospam snort[6297]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:22:26 nospam snort[6297]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:22:26 nospam snort[6297]: Var 'eth1_ADDRESS' defined, value len = 25 chars Nov 17 21:22:26 nospam snort[6297]: , value = 192.168.1.0/255.255.255.0 Nov 17 21:22:26 nospam snort[6297]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:22:26 nospam snort[6297]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:22:26 nospam snort[6297]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:22:26 nospam snort[6297]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:22:26 nospam snort[6297]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:22:26 nospam snort[6297]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:22:26 nospam snort[6297]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:22:26 nospam snort[6297]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:22:26 nospam snort[6297]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:22:26 nospam snort[6297]: Var 'HOME_NET' redefined Nov 17 21:22:26 nospam snort[6297]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:22:26 nospam snort[6297]: , value = any Nov 17 21:22:26 nospam snort[6297]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:22:26 nospam snort[6297]: , value = [192.168.1.0/24] Nov 17 21:22:26 nospam snort[6297]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:22:26 nospam snort[6297]: , value = [192.168.1.0/24] Nov 17 21:22:26 nospam snort[6297]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:22:26 nospam snort[6297]: , value = [192.168.1.0/24] Nov 17 21:22:26 nospam snort[6297]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:22:26 nospam snort[6297]: , value = [192.168.1.0/24] Nov 17 21:22:26 nospam snort[6297]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:22:26 nospam snort[6297]: , value = [192.168.1.0/24] Nov 17 21:22:26 nospam snort[6297]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:22:26 nospam snort[6297]: , value = [192.168.1.0/24] Nov 17 21:22:26 nospam snort[6297]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:22:26 nospam snort[6297]: , value = 80 Nov 17 21:22:26 nospam snort[6297]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:22:26 nospam snort[6297]: , value = !80 Nov 17 21:22:26 nospam snort[6297]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:22:26 nospam snort[6297]: , value = 1521 Nov 17 21:22:26 nospam snort[6297]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:22:26 nospam snort[6297]: Nov 17 21:22:26 nospam snort[6297]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:22:26 nospam snort[6297]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:22:26 nospam snort[6297]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:22:26 nospam snort[6297]: , value = /etc/snort/rules Nov 17 21:22:26 nospam snort[6297]: ,-----------[Flow Config]---------------------- Nov 17 21:22:26 nospam snort[6297]: | Stats Interval: 0 Nov 17 21:22:26 nospam snort[6297]: | Hash Method: 2 Nov 17 21:22:26 nospam snort[6297]: | Memcap: 10485760 Nov 17 21:22:26 nospam snort[6297]: | Rows : 4099 Nov 17 21:22:26 nospam snort[6297]: | Overhead Bytes: 32800(%0.31) Nov 17 21:22:26 nospam snort[6297]: `---------------------------------------------- Nov 17 21:22:26 nospam snort[6297]: Frag3 global config: Nov 17 21:22:26 nospam snort[6297]: Max frags: 65536 Nov 17 21:22:26 nospam snort[6297]: Fragment memory cap: 4194304 bytes Nov 17 21:22:26 nospam snort[6297]: Frag3 engine config: Nov 17 21:22:26 nospam snort[6297]: Target-based policy: FIRST Nov 17 21:22:26 nospam snort[6297]: Fragment timeout: 60 seconds Nov 17 21:22:26 nospam snort[6297]: Fragment min_ttl: 1 Nov 17 21:22:26 nospam snort[6297]: Fragment ttl_limit: 5 Nov 17 21:22:26 nospam snort[6297]: Fragment Problems: 1 Nov 17 21:22:26 nospam snort[6297]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:22:26 nospam snort[6297]: Stream5 global config: Nov 17 21:22:26 nospam snort[6297]: Track TCP sessions: ACTIVE Nov 17 21:22:26 nospam snort[6297]: Max TCP sessions: 8192 Nov 17 21:22:26 nospam snort[6297]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:22:26 nospam snort[6297]: Track UDP sessions: INACTIVE Nov 17 21:22:26 nospam snort[6297]: Track ICMP sessions: INACTIVE Nov 17 21:22:26 nospam snort[6297]: Stream5 TCP Policy config: Nov 17 21:22:26 nospam snort[6297]: Reassembly Policy: FIRST Nov 17 21:22:26 nospam snort[6297]: Timeout: 30 seconds Nov 17 21:22:26 nospam snort[6297]: Min ttl: 1 Nov 17 21:22:26 nospam snort[6297]: Options: Nov 17 21:22:26 nospam snort[6297]: Static Flushpoint Sizes: YES Nov 17 21:22:26 nospam snort[6297]: Reassembly Ports: Nov 17 21:22:26 nospam snort[6297]: 21 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 23 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 25 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 42 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 53 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 80 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 110 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 111 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 135 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 136 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 137 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 139 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 143 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 445 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 513 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 1433 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 1521 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: 3306 client (Footprint) Nov 17 21:22:26 nospam snort[6297]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:22:26 nospam snort[6297]: HttpInspect Config: Nov 17 21:22:26 nospam snort[6297]: GLOBAL CONFIG Nov 17 21:22:26 nospam snort[6297]: Max Pipeline Requests: 0 Nov 17 21:22:26 nospam snort[6297]: Inspection Type: STATELESS Nov 17 21:22:26 nospam snort[6297]: Detect Proxy Usage: NO Nov 17 21:22:26 nospam snort[6297]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:22:26 nospam snort[6297]: IIS Unicode Map Codepage: 1252 Nov 17 21:22:26 nospam snort[6297]: DEFAULT SERVER CONFIG: Nov 17 21:22:26 nospam snort[6297]: Server profile: All Nov 17 21:22:26 nospam snort[6297]: Ports: 80 8080 8180 Nov 17 21:22:26 nospam snort[6297]: Flow Depth: 300 Nov 17 21:22:26 nospam snort[6297]: Max Chunk Length: 500000 Nov 17 21:22:26 nospam snort[6297]: Inspect Pipeline Requests: YES Nov 17 21:22:26 nospam snort[6297]: URI Discovery Strict Mode: NO Nov 17 21:22:26 nospam snort[6297]: Allow Proxy Usage: NO Nov 17 21:22:26 nospam snort[6297]: Disable Alerting: NO Nov 17 21:22:26 nospam snort[6297]: Oversize Dir Length: 500 Nov 17 21:22:26 nospam snort[6297]: Only inspect URI: NO Nov 17 21:22:26 nospam snort[6297]: Ascii: YES alert: NO Nov 17 21:22:26 nospam snort[6297]: Double Decoding: YES alert: YES Nov 17 21:22:26 nospam snort[6297]: %U Encoding: YES alert: YES Nov 17 21:22:26 nospam snort[6297]: Bare Byte: YES alert: YES Nov 17 21:22:26 nospam snort[6297]: Base36: OFF Nov 17 21:22:26 nospam snort[6297]: UTF 8: OFF Nov 17 21:22:26 nospam snort[6297]: IIS Unicode: YES alert: YES Nov 17 21:22:26 nospam snort[6297]: Multiple Slash: YES alert: NO Nov 17 21:22:26 nospam snort[6297]: IIS Backslash: YES alert: NO Nov 17 21:22:26 nospam snort[6297]: Directory Traversal: YES alert: NO Nov 17 21:22:26 nospam snort[6297]: Web Root Traversal: YES alert: YES Nov 17 21:22:26 nospam snort[6297]: Apache WhiteSpace: YES alert: NO Nov 17 21:22:26 nospam snort[6297]: IIS Delimiter: YES alert: NO Nov 17 21:22:26 nospam snort[6297]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:22:26 nospam snort[6297]: Non-RFC Compliant Characters: NONE Nov 17 21:22:26 nospam snort[6297]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:22:26 nospam snort[6297]: rpc_decode arguments: Nov 17 21:22:26 nospam snort[6297]: Ports to decode RPC on: 111 32771 Nov 17 21:22:26 nospam snort[6297]: alert_fragments: INACTIVE Nov 17 21:22:26 nospam snort[6297]: alert_large_fragments: ACTIVE Nov 17 21:22:26 nospam snort[6297]: alert_incomplete: ACTIVE Nov 17 21:22:26 nospam snort[6297]: alert_multiple_requests: ACTIVE Nov 17 21:22:26 nospam snort[6297]: Portscan Detection Config: Nov 17 21:22:26 nospam snort[6297]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:22:26 nospam snort[6297]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:22:26 nospam snort[6297]: Sensitivity Level: Low Nov 17 21:22:26 nospam snort[6297]: Memcap (in bytes): 10000000 Nov 17 21:22:26 nospam snort[6297]: Number of Nodes: 26109 Nov 17 21:22:26 nospam snort[6297]: Nov 17 21:22:26 nospam snort[6297]: Tagged Packet Limit: 256 Nov 17 21:22:26 nospam snort[6297]: Nov 17 21:22:26 nospam snort[6297]: +-----------------------[thresholding-config]---------------------------------- Nov 17 21:22:26 nospam snort[6297]: | memory-cap : 1048576 bytes Nov 17 21:22:26 nospam snort[6297]: +-----------------------[thresholding-global]---------------------------------- Nov 17 21:22:26 nospam snort[6297]: | none Nov 17 21:22:26 nospam snort[6297]: +-----------------------[thresholding-local]----------------------------------- Nov 17 21:22:26 nospam snort[6297]: | none Nov 17 21:22:26 nospam snort[6297]: +-----------------------[suppression]------------------------------------------ Nov 17 21:22:26 nospam snort[6297]: | none Nov 17 21:22:26 nospam snort[6297]: ------------------------------------------------------------------------------- Nov 17 21:22:26 nospam snort[6297]: Rule application order: activation->dynamic->pass->drop->alert->log Nov 17 21:22:26 nospam snort[6297]: Log directory = /var/log/snort Nov 17 21:22:26 nospam snort[6297]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Nov 17 21:22:26 nospam snort[6297]: done Nov 17 21:22:26 nospam snort[6297]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Nov 17 21:22:26 nospam snort[6297]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 17 21:22:26 nospam snort[6297]: done Nov 17 21:22:26 nospam snort[6297]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 17 21:22:26 nospam snort[6297]: done Nov 17 21:22:26 nospam snort[6297]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... Nov 17 21:22:26 nospam snort[6297]: done Nov 17 21:22:26 nospam snort[6297]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 17 21:22:26 nospam snort[6297]: done Nov 17 21:22:26 nospam snort[6297]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Nov 17 21:22:26 nospam snort[6297]: done Nov 17 21:22:26 nospam snort[6297]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Nov 17 21:22:26 nospam snort[6297]: FTPTelnet Config: Nov 17 21:22:26 nospam snort[6297]: GLOBAL CONFIG Nov 17 21:22:26 nospam snort[6297]: Inspection Type: stateful Nov 17 21:22:26 nospam snort[6297]: Check for Encrypted Traffic: YES alert: YES Nov 17 21:22:26 nospam snort[6297]: Continue to check encrypted data: NO Nov 17 21:22:26 nospam snort[6297]: TELNET CONFIG: Nov 17 21:22:26 nospam snort[6297]: Ports: 23 Nov 17 21:22:26 nospam snort[6297]: Are You There Threshold: 200 Nov 17 21:22:26 nospam snort[6297]: Normalize: YES Nov 17 21:22:26 nospam snort[6297]: Detect Anomalies: NO Nov 17 21:22:26 nospam snort[6297]: FTP CONFIG: Nov 17 21:22:26 nospam snort[6297]: FTP Server: default Nov 17 21:22:26 nospam snort[6297]: Ports: 21 Nov 17 21:22:26 nospam snort[6297]: Check for Telnet Cmds: YES alert: YES Nov 17 21:22:26 nospam snort[6297]: Identify open data channels: YES Nov 17 21:22:26 nospam snort[6297]: FTP Client: default Nov 17 21:22:26 nospam snort[6297]: Check for Bounce Attacks: YES alert: YES Nov 17 21:22:26 nospam snort[6297]: Check for Telnet Cmds: YES alert: YES Nov 17 21:22:26 nospam snort[6297]: Max Response Length: 256 Nov 17 21:22:26 nospam snort[6297]: SMTP Config: Nov 17 21:22:26 nospam snort[6297]: Ports: Nov 17 21:22:26 nospam snort[6297]: 25 Nov 17 21:22:26 nospam snort[6297]: Nov 17 21:22:26 nospam snort[6297]: Inspection Type: STATEFUL Nov 17 21:22:26 nospam snort[6297]: Normalize Spaces: YES Nov 17 21:22:26 nospam snort[6297]: Ignore Data: NO Nov 17 21:22:26 nospam snort[6297]: Ignore TLS Data: NO Nov 17 21:22:26 nospam snort[6297]: Ignore Alerts: NO Nov 17 21:22:26 nospam snort[6297]: Max Command Length: 0 Nov 17 21:22:26 nospam snort[6297]: Max Header Line Length: 0 Nov 17 21:22:26 nospam snort[6297]: Max Response Line Length: 0 Nov 17 21:22:26 nospam snort[6297]: X-Link2State Alert: YES Nov 17 21:22:26 nospam snort[6297]: Drop on X-Link2State Alert: NO Nov 17 21:22:26 nospam snort[6297]: DCE/RPC Decoder config: Nov 17 21:22:26 nospam snort[6297]: Autodetect ports ENABLED Nov 17 21:22:26 nospam snort[6297]: SMB fragmentation ENABLED Nov 17 21:22:26 nospam snort[6297]: DCE/RPC fragmentation ENABLED Nov 17 21:22:26 nospam snort[6297]: Max Frag Size: 3000 bytes Nov 17 21:22:26 nospam snort[6297]: Memcap: 100000 KB Nov 17 21:22:26 nospam snort[6297]: Alert if memcap exceeded DISABLED Nov 17 21:22:26 nospam snort[6297]: Nov 17 21:22:26 nospam snort[6297]: DNS config: Nov 17 21:22:26 nospam snort[6297]: DNS Client rdata txt Overflow Alert: ACTIVE Nov 17 21:22:26 nospam snort[6297]: Obsolete DNS RR Types Alert: INACTIVE Nov 17 21:22:26 nospam snort[6297]: Experimental DNS RR Types Alert: INACTIVE Nov 17 21:22:26 nospam snort[6297]: Ports: Nov 17 21:22:26 nospam snort[6297]: 53 Nov 17 21:22:26 nospam snort[6297]: Nov 17 21:22:27 nospam snort[6297]: Warning: flowbits key 'community_uri.size.1050' is set but not ever checked. Nov 17 21:22:27 nospam snort[6297]: 296 out of 512 flowbits in use. Nov 17 21:22:27 nospam snort[6297]: Initializing daemon mode Nov 17 21:22:27 nospam snort[6299]: PID path stat checked out ok, PID path set to /var/run/ Nov 17 21:22:27 nospam snort[6299]: Writing PID "6299" to file "/var/run//snort_eth0.pid" Nov 17 21:22:27 nospam snort[6297]: Daemon parent exiting Nov 17 21:22:27 nospam snort[6299]: Daemon initialized, signaled parent pid: 6297 Nov 17 21:26:22 nospam snort[6299]: Preprocessor/Decoder Rule Count: 0 Nov 17 21:26:22 nospam snort[6299]: Snort initialization completed successfully (pid=6299) Nov 17 21:26:22 nospam snort[6299]: Not Using PCAP_FRAMES Nov 17 21:26:22 nospam snort[6299]: pcap_loop: recvfrom: Network is down Nov 17 21:26:22 nospam snort[6299]: Frag3 statistics: Nov 17 21:26:22 nospam snort[6299]: Total Fragments: 0 Nov 17 21:26:22 nospam snort[6299]: Frags Reassembled: 0 Nov 17 21:26:22 nospam snort[6299]: Discards: 0 Nov 17 21:26:22 nospam snort[6299]: Memory Faults: 0 Nov 17 21:26:22 nospam snort[6299]: Timeouts: 0 Nov 17 21:26:22 nospam snort[6299]: Overlaps: 0 Nov 17 21:26:22 nospam snort[6299]: Anomalies: 0 Nov 17 21:26:22 nospam snort[6299]: Alerts: 0 Nov 17 21:26:22 nospam snort[6299]: FragTrackers Added: 0 Nov 17 21:26:22 nospam snort[6299]: FragTrackers Dumped: 0 Nov 17 21:26:22 nospam snort[6299]: FragTrackers Auto Freed: 0 Nov 17 21:26:22 nospam snort[6299]: Frag Nodes Inserted: 0 Nov 17 21:26:22 nospam snort[6299]: Frag Nodes Deleted: 0 Nov 17 21:26:22 nospam snort[6299]: =============================================================================== Nov 17 21:26:22 nospam snort[6299]: Stream5 statistics: Nov 17 21:26:22 nospam snort[6299]: Total sessions: 0 Nov 17 21:26:22 nospam snort[6299]: TCP sessions: 0 Nov 17 21:26:22 nospam snort[6299]: UDP sessions: 0 Nov 17 21:26:22 nospam snort[6299]: ICMP sessions: 0 Nov 17 21:26:22 nospam snort[6299]: TCP Prunes: 0 Nov 17 21:26:22 nospam snort[6299]: UDP Prunes: 0 Nov 17 21:26:22 nospam snort[6299]: ICMP Prunes: 0 Nov 17 21:26:22 nospam snort[6299]: TCP StreamTrackers Created: 0 Nov 17 21:26:22 nospam snort[6299]: TCP StreamTrackers Deleted: 0 Nov 17 21:26:22 nospam snort[6299]: TCP Timeouts: 0 Nov 17 21:26:22 nospam snort[6299]: TCP Overlaps: 0 Nov 17 21:26:22 nospam snort[6299]: TCP Segments Queued: 0 Nov 17 21:26:22 nospam snort[6299]: TCP Segments Released: 0 Nov 17 21:26:22 nospam snort[6299]: TCP Rebuilt Packets: 0 Nov 17 21:26:22 nospam snort[6299]: TCP Segments Used: 0 Nov 17 21:26:22 nospam snort[6299]: TCP Discards: 0 Nov 17 21:26:22 nospam snort[6299]: UDP Sessions Created: 0 Nov 17 21:26:22 nospam snort[6299]: UDP Sessions Deleted: 0 Nov 17 21:26:22 nospam snort[6299]: UDP Timeouts: 0 Nov 17 21:26:22 nospam snort[6299]: UDP Discards: 0 Nov 17 21:26:22 nospam snort[6299]: Events: 0 Nov 17 21:26:22 nospam snort[6299]: =============================================================================== Nov 17 21:26:22 nospam snort[6299]: Final Flow Statistics Nov 17 21:26:23 nospam snort[6299]: Snort exiting Nov 17 21:26:23 nospam snort[6299]: Could not remove pid file /var/run//snort_eth0.pid: Permission denied Nov 17 21:34:43 nospam snort[7265]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:34:43 nospam snort[7265]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:34:43 nospam snort[7265]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 21:34:43 nospam snort[7265]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:34:43 nospam snort[7265]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:34:43 nospam snort[7265]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:34:43 nospam snort[7265]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:34:43 nospam snort[7265]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:34:43 nospam snort[7265]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:34:43 nospam snort[7265]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:34:43 nospam snort[7265]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:34:43 nospam snort[7265]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:34:43 nospam snort[7265]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:34:43 nospam snort[7265]: Var 'HOME_NET' redefined Nov 17 21:34:43 nospam snort[7265]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:34:43 nospam snort[7265]: , value = any Nov 17 21:34:43 nospam snort[7265]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:34:43 nospam snort[7265]: , value = [192.168.1.0/24] Nov 17 21:34:43 nospam snort[7265]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:34:43 nospam snort[7265]: , value = [192.168.1.0/24] Nov 17 21:34:43 nospam snort[7265]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:34:43 nospam snort[7265]: , value = [192.168.1.0/24] Nov 17 21:34:43 nospam snort[7265]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:34:43 nospam snort[7265]: , value = [192.168.1.0/24] Nov 17 21:34:43 nospam snort[7265]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:34:43 nospam snort[7265]: , value = [192.168.1.0/24] Nov 17 21:34:43 nospam snort[7265]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:34:43 nospam snort[7265]: , value = [192.168.1.0/24] Nov 17 21:34:43 nospam snort[7265]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:34:43 nospam snort[7265]: , value = 80 Nov 17 21:34:43 nospam snort[7265]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:34:43 nospam snort[7265]: , value = !80 Nov 17 21:34:43 nospam snort[7265]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:34:43 nospam snort[7265]: , value = 1521 Nov 17 21:34:43 nospam snort[7265]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:34:43 nospam snort[7265]: Nov 17 21:34:43 nospam snort[7265]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:34:43 nospam snort[7265]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:34:43 nospam snort[7265]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:34:43 nospam snort[7265]: , value = /etc/snort/rules Nov 17 21:34:43 nospam snort[7265]: ,-----------[Flow Config]---------------------- Nov 17 21:34:43 nospam snort[7265]: | Stats Interval: 0 Nov 17 21:34:43 nospam snort[7265]: | Hash Method: 2 Nov 17 21:34:43 nospam snort[7265]: | Memcap: 10485760 Nov 17 21:34:43 nospam snort[7265]: | Rows : 4099 Nov 17 21:34:43 nospam snort[7265]: | Overhead Bytes: 32800(%0.31) Nov 17 21:34:43 nospam snort[7265]: `---------------------------------------------- Nov 17 21:34:43 nospam snort[7265]: Frag3 global config: Nov 17 21:34:43 nospam snort[7265]: Max frags: 65536 Nov 17 21:34:43 nospam snort[7265]: Fragment memory cap: 4194304 bytes Nov 17 21:34:43 nospam snort[7265]: Frag3 engine config: Nov 17 21:34:43 nospam snort[7265]: Target-based policy: FIRST Nov 17 21:34:43 nospam snort[7265]: Fragment timeout: 60 seconds Nov 17 21:34:43 nospam snort[7265]: Fragment min_ttl: 1 Nov 17 21:34:43 nospam snort[7265]: Fragment ttl_limit: 5 Nov 17 21:34:43 nospam snort[7265]: Fragment Problems: 1 Nov 17 21:34:43 nospam snort[7265]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:34:43 nospam snort[7265]: Stream5 global config: Nov 17 21:34:43 nospam snort[7265]: Track TCP sessions: ACTIVE Nov 17 21:34:43 nospam snort[7265]: Max TCP sessions: 8192 Nov 17 21:34:43 nospam snort[7265]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:34:43 nospam snort[7265]: Track UDP sessions: INACTIVE Nov 17 21:34:43 nospam snort[7265]: Track ICMP sessions: INACTIVE Nov 17 21:34:43 nospam snort[7265]: Stream5 TCP Policy config: Nov 17 21:34:43 nospam snort[7265]: Reassembly Policy: FIRST Nov 17 21:34:43 nospam snort[7265]: Timeout: 30 seconds Nov 17 21:34:43 nospam snort[7265]: Min ttl: 1 Nov 17 21:34:43 nospam snort[7265]: Options: Nov 17 21:34:43 nospam snort[7265]: Static Flushpoint Sizes: YES Nov 17 21:34:43 nospam snort[7265]: Reassembly Ports: Nov 17 21:34:43 nospam snort[7265]: 21 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 23 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 25 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 42 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 53 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 80 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 110 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 111 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 135 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 136 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 137 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 139 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 143 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 445 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 513 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 1433 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 1521 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: 3306 client (Footprint) Nov 17 21:34:43 nospam snort[7265]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:34:43 nospam snort[7265]: HttpInspect Config: Nov 17 21:34:43 nospam snort[7265]: GLOBAL CONFIG Nov 17 21:34:43 nospam snort[7265]: Max Pipeline Requests: 0 Nov 17 21:34:43 nospam snort[7265]: Inspection Type: STATELESS Nov 17 21:34:43 nospam snort[7265]: Detect Proxy Usage: NO Nov 17 21:34:43 nospam snort[7265]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:34:43 nospam snort[7265]: IIS Unicode Map Codepage: 1252 Nov 17 21:34:43 nospam snort[7265]: DEFAULT SERVER CONFIG: Nov 17 21:34:43 nospam snort[7265]: Server profile: All Nov 17 21:34:43 nospam snort[7265]: Ports: 80 8080 8180 Nov 17 21:34:43 nospam snort[7265]: Flow Depth: 300 Nov 17 21:34:43 nospam snort[7265]: Max Chunk Length: 500000 Nov 17 21:34:43 nospam snort[7265]: Inspect Pipeline Requests: YES Nov 17 21:34:43 nospam snort[7265]: URI Discovery Strict Mode: NO Nov 17 21:34:43 nospam snort[7265]: Allow Proxy Usage: NO Nov 17 21:34:43 nospam snort[7265]: Disable Alerting: NO Nov 17 21:34:43 nospam snort[7265]: Oversize Dir Length: 500 Nov 17 21:34:43 nospam snort[7265]: Only inspect URI: NO Nov 17 21:34:43 nospam snort[7265]: Ascii: YES alert: NO Nov 17 21:34:43 nospam snort[7265]: Double Decoding: YES alert: YES Nov 17 21:34:43 nospam snort[7265]: %U Encoding: YES alert: YES Nov 17 21:34:43 nospam snort[7265]: Bare Byte: YES alert: YES Nov 17 21:34:43 nospam snort[7265]: Base36: OFF Nov 17 21:34:43 nospam snort[7265]: UTF 8: OFF Nov 17 21:34:43 nospam snort[7265]: IIS Unicode: YES alert: YES Nov 17 21:34:43 nospam snort[7265]: Multiple Slash: YES alert: NO Nov 17 21:34:43 nospam snort[7265]: IIS Backslash: YES alert: NO Nov 17 21:34:43 nospam snort[7265]: Directory Traversal: YES alert: NO Nov 17 21:34:43 nospam snort[7265]: Web Root Traversal: YES alert: YES Nov 17 21:34:43 nospam snort[7265]: Apache WhiteSpace: YES alert: NO Nov 17 21:34:43 nospam snort[7265]: IIS Delimiter: YES alert: NO Nov 17 21:34:43 nospam snort[7265]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:34:43 nospam snort[7265]: Non-RFC Compliant Characters: NONE Nov 17 21:34:43 nospam snort[7265]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:34:43 nospam snort[7265]: rpc_decode arguments: Nov 17 21:34:43 nospam snort[7265]: Ports to decode RPC on: 111 32771 Nov 17 21:34:43 nospam snort[7265]: alert_fragments: INACTIVE Nov 17 21:34:43 nospam snort[7265]: alert_large_fragments: ACTIVE Nov 17 21:34:43 nospam snort[7265]: alert_incomplete: ACTIVE Nov 17 21:34:43 nospam snort[7265]: alert_multiple_requests: ACTIVE Nov 17 21:34:43 nospam snort[7265]: Portscan Detection Config: Nov 17 21:34:43 nospam snort[7265]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:34:43 nospam snort[7265]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:34:43 nospam snort[7265]: Sensitivity Level: Low Nov 17 21:34:43 nospam snort[7265]: Memcap (in bytes): 10000000 Nov 17 21:34:43 nospam snort[7265]: Number of Nodes: 26109 Nov 17 21:34:43 nospam snort[7265]: Nov 17 21:34:43 nospam snort[7265]: Tagged Packet Limit: 256 Nov 17 21:34:43 nospam snort[7265]: Nov 17 21:34:43 nospam snort[7265]: +-----------------------[thresholding-config]---------------------------------- Nov 17 21:34:43 nospam snort[7265]: | memory-cap : 1048576 bytes Nov 17 21:34:43 nospam snort[7265]: +-----------------------[thresholding-global]---------------------------------- Nov 17 21:34:43 nospam snort[7265]: | none Nov 17 21:34:43 nospam snort[7265]: +-----------------------[thresholding-local]----------------------------------- Nov 17 21:34:43 nospam snort[7265]: | none Nov 17 21:34:43 nospam snort[7265]: +-----------------------[suppression]------------------------------------------ Nov 17 21:34:43 nospam snort[7265]: | none Nov 17 21:34:43 nospam snort[7265]: ------------------------------------------------------------------------------- Nov 17 21:34:43 nospam snort[7265]: Rule application order: activation->dynamic->pass->drop->alert->log Nov 17 21:34:43 nospam snort[7265]: Log directory = /var/log/snort Nov 17 21:34:43 nospam snort[7265]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Nov 17 21:34:43 nospam snort[7265]: done Nov 17 21:34:43 nospam snort[7265]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Nov 17 21:34:43 nospam snort[7265]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 17 21:34:43 nospam snort[7265]: done Nov 17 21:34:43 nospam snort[7265]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 17 21:34:43 nospam snort[7265]: done Nov 17 21:34:43 nospam snort[7265]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... Nov 17 21:34:43 nospam snort[7265]: done Nov 17 21:34:43 nospam snort[7265]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 17 21:34:43 nospam snort[7265]: done Nov 17 21:34:43 nospam snort[7265]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Nov 17 21:34:43 nospam snort[7265]: done Nov 17 21:34:43 nospam snort[7265]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Nov 17 21:34:43 nospam snort[7265]: FTPTelnet Config: Nov 17 21:34:43 nospam snort[7265]: GLOBAL CONFIG Nov 17 21:34:43 nospam snort[7265]: Inspection Type: stateful Nov 17 21:34:43 nospam snort[7265]: Check for Encrypted Traffic: YES alert: YES Nov 17 21:34:43 nospam snort[7265]: Continue to check encrypted data: NO Nov 17 21:34:43 nospam snort[7265]: TELNET CONFIG: Nov 17 21:34:43 nospam snort[7265]: Ports: 23 Nov 17 21:34:43 nospam snort[7265]: Are You There Threshold: 200 Nov 17 21:34:43 nospam snort[7265]: Normalize: YES Nov 17 21:34:43 nospam snort[7265]: Detect Anomalies: NO Nov 17 21:34:43 nospam snort[7265]: FTP CONFIG: Nov 17 21:34:43 nospam snort[7265]: FTP Server: default Nov 17 21:34:43 nospam snort[7265]: Ports: 21 Nov 17 21:34:43 nospam snort[7265]: Check for Telnet Cmds: YES alert: YES Nov 17 21:34:43 nospam snort[7265]: Identify open data channels: YES Nov 17 21:34:43 nospam snort[7265]: FTP Client: default Nov 17 21:34:43 nospam snort[7265]: Check for Bounce Attacks: YES alert: YES Nov 17 21:34:43 nospam snort[7265]: Check for Telnet Cmds: YES alert: YES Nov 17 21:34:43 nospam snort[7265]: Max Response Length: 256 Nov 17 21:34:43 nospam snort[7265]: SMTP Config: Nov 17 21:34:43 nospam snort[7265]: Ports: Nov 17 21:34:43 nospam snort[7265]: 25 Nov 17 21:34:43 nospam snort[7265]: Nov 17 21:34:43 nospam snort[7265]: Inspection Type: STATEFUL Nov 17 21:34:43 nospam snort[7265]: Normalize Spaces: YES Nov 17 21:34:43 nospam snort[7265]: Ignore Data: NO Nov 17 21:34:43 nospam snort[7265]: Ignore TLS Data: NO Nov 17 21:34:43 nospam snort[7265]: Ignore Alerts: NO Nov 17 21:34:43 nospam snort[7265]: Max Command Length: 0 Nov 17 21:34:43 nospam snort[7265]: Max Header Line Length: 0 Nov 17 21:34:43 nospam snort[7265]: Max Response Line Length: 0 Nov 17 21:34:43 nospam snort[7265]: X-Link2State Alert: YES Nov 17 21:34:43 nospam snort[7265]: Drop on X-Link2State Alert: NO Nov 17 21:34:43 nospam snort[7265]: DCE/RPC Decoder config: Nov 17 21:34:43 nospam snort[7265]: Autodetect ports ENABLED Nov 17 21:34:43 nospam snort[7265]: SMB fragmentation ENABLED Nov 17 21:34:43 nospam snort[7265]: DCE/RPC fragmentation ENABLED Nov 17 21:34:43 nospam snort[7265]: Max Frag Size: 3000 bytes Nov 17 21:34:43 nospam snort[7265]: Memcap: 100000 KB Nov 17 21:34:43 nospam snort[7265]: Alert if memcap exceeded DISABLED Nov 17 21:34:43 nospam snort[7265]: Nov 17 21:34:43 nospam snort[7265]: DNS config: Nov 17 21:34:43 nospam snort[7265]: DNS Client rdata txt Overflow Alert: ACTIVE Nov 17 21:34:43 nospam snort[7265]: Obsolete DNS RR Types Alert: INACTIVE Nov 17 21:34:43 nospam snort[7265]: Experimental DNS RR Types Alert: INACTIVE Nov 17 21:34:43 nospam snort[7265]: Ports: Nov 17 21:34:43 nospam snort[7265]: 53 Nov 17 21:34:43 nospam snort[7265]: Nov 17 21:34:44 nospam snort[7265]: Warning: flowbits key 'community_uri.size.1050' is set but not ever checked. Nov 17 21:34:44 nospam snort[7265]: 296 out of 512 flowbits in use. Nov 17 21:34:44 nospam snort[7265]: Initializing daemon mode Nov 17 21:34:44 nospam snort[7266]: PID path stat checked out ok, PID path set to /var/run/ Nov 17 21:34:44 nospam snort[7266]: Writing PID "7266" to file "/var/run//snort_eth0.pid" Nov 17 21:34:44 nospam snort[7265]: Daemon parent exiting Nov 17 21:34:44 nospam snort[7266]: Daemon initialized, signaled parent pid: 7265 Nov 17 21:38:51 nospam snort[7655]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:38:51 nospam snort[7655]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:38:51 nospam snort[7655]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 21:38:51 nospam snort[7655]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:38:51 nospam snort[7655]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:38:51 nospam snort[7655]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:38:51 nospam snort[7655]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:38:51 nospam snort[7655]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:38:51 nospam snort[7655]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:38:51 nospam snort[7655]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:38:51 nospam snort[7655]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:38:51 nospam snort[7655]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:38:51 nospam snort[7655]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:38:51 nospam snort[7655]: Var 'HOME_NET' redefined Nov 17 21:38:51 nospam snort[7655]: Var 'EXTERNAL_NET' defined, value len = 3 chars Nov 17 21:38:51 nospam snort[7655]: , value = any Nov 17 21:38:51 nospam snort[7655]: Var 'DNS_SERVERS' defined, value len = 16 chars Nov 17 21:38:51 nospam snort[7655]: , value = [192.168.1.0/24] Nov 17 21:38:51 nospam snort[7655]: Var 'SMTP_SERVERS' defined, value len = 16 chars Nov 17 21:38:51 nospam snort[7655]: , value = [192.168.1.0/24] Nov 17 21:38:51 nospam snort[7655]: Var 'HTTP_SERVERS' defined, value len = 16 chars Nov 17 21:38:51 nospam snort[7655]: , value = [192.168.1.0/24] Nov 17 21:38:51 nospam snort[7655]: Var 'SQL_SERVERS' defined, value len = 16 chars Nov 17 21:38:51 nospam snort[7655]: , value = [192.168.1.0/24] Nov 17 21:38:51 nospam snort[7655]: Var 'TELNET_SERVERS' defined, value len = 16 chars Nov 17 21:38:51 nospam snort[7655]: , value = [192.168.1.0/24] Nov 17 21:38:51 nospam snort[7655]: Var 'SNMP_SERVERS' defined, value len = 16 chars Nov 17 21:38:51 nospam snort[7655]: , value = [192.168.1.0/24] Nov 17 21:38:51 nospam snort[7655]: Var 'HTTP_PORTS' defined, value len = 2 chars Nov 17 21:38:51 nospam snort[7655]: , value = 80 Nov 17 21:38:51 nospam snort[7655]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars Nov 17 21:38:51 nospam snort[7655]: , value = !80 Nov 17 21:38:51 nospam snort[7655]: Var 'ORACLE_PORTS' defined, value len = 4 chars Nov 17 21:38:51 nospam snort[7655]: , value = 1521 Nov 17 21:38:51 nospam snort[7655]: Var 'AIM_SERVERS' defined, value len = 185 chars Nov 17 21:38:51 nospam snort[7655]: Nov 17 21:38:51 nospam snort[7655]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9 Nov 17 21:38:51 nospam snort[7655]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24] Nov 17 21:38:51 nospam snort[7655]: Var 'RULE_PATH' defined, value len = 16 chars Nov 17 21:38:51 nospam snort[7655]: , value = /etc/snort/rules Nov 17 21:38:51 nospam snort[7655]: ,-----------[Flow Config]---------------------- Nov 17 21:38:51 nospam snort[7655]: | Stats Interval: 0 Nov 17 21:38:51 nospam snort[7655]: | Hash Method: 2 Nov 17 21:38:51 nospam snort[7655]: | Memcap: 10485760 Nov 17 21:38:51 nospam snort[7655]: | Rows : 4099 Nov 17 21:38:51 nospam snort[7655]: | Overhead Bytes: 32800(%0.31) Nov 17 21:38:51 nospam snort[7655]: `---------------------------------------------- Nov 17 21:38:51 nospam snort[7655]: Frag3 global config: Nov 17 21:38:51 nospam snort[7655]: Max frags: 65536 Nov 17 21:38:51 nospam snort[7655]: Fragment memory cap: 4194304 bytes Nov 17 21:38:51 nospam snort[7655]: Frag3 engine config: Nov 17 21:38:51 nospam snort[7655]: Target-based policy: FIRST Nov 17 21:38:51 nospam snort[7655]: Fragment timeout: 60 seconds Nov 17 21:38:51 nospam snort[7655]: Fragment min_ttl: 1 Nov 17 21:38:51 nospam snort[7655]: Fragment ttl_limit: 5 Nov 17 21:38:51 nospam snort[7655]: Fragment Problems: 1 Nov 17 21:38:51 nospam snort[7655]: Bound Addresses: 0.0.0.0/0.0.0.0 Nov 17 21:38:51 nospam snort[7655]: Stream5 global config: Nov 17 21:38:51 nospam snort[7655]: Track TCP sessions: ACTIVE Nov 17 21:38:51 nospam snort[7655]: Max TCP sessions: 8192 Nov 17 21:38:51 nospam snort[7655]: Memcap (for reassembly packet storage): 8388608 Nov 17 21:38:51 nospam snort[7655]: Track UDP sessions: INACTIVE Nov 17 21:38:51 nospam snort[7655]: Track ICMP sessions: INACTIVE Nov 17 21:38:51 nospam snort[7655]: Stream5 TCP Policy config: Nov 17 21:38:51 nospam snort[7655]: Reassembly Policy: FIRST Nov 17 21:38:51 nospam snort[7655]: Timeout: 30 seconds Nov 17 21:38:51 nospam snort[7655]: Min ttl: 1 Nov 17 21:38:51 nospam snort[7655]: Options: Nov 17 21:38:51 nospam snort[7655]: Static Flushpoint Sizes: YES Nov 17 21:38:51 nospam snort[7655]: Reassembly Ports: Nov 17 21:38:51 nospam snort[7655]: 21 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 23 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 25 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 42 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 53 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 80 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 110 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 111 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 135 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 136 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 137 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 139 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 143 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 445 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 513 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 1433 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 1521 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: 3306 client (Footprint) Nov 17 21:38:51 nospam snort[7655]: Bound Addresses:0.0.0.0/0.0.0.0 Nov 17 21:38:51 nospam snort[7655]: HttpInspect Config: Nov 17 21:38:51 nospam snort[7655]: GLOBAL CONFIG Nov 17 21:38:51 nospam snort[7655]: Max Pipeline Requests: 0 Nov 17 21:38:51 nospam snort[7655]: Inspection Type: STATELESS Nov 17 21:38:51 nospam snort[7655]: Detect Proxy Usage: NO Nov 17 21:38:51 nospam snort[7655]: IIS Unicode Map Filename: /etc/snort/unicode.map Nov 17 21:38:51 nospam snort[7655]: IIS Unicode Map Codepage: 1252 Nov 17 21:38:51 nospam snort[7655]: DEFAULT SERVER CONFIG: Nov 17 21:38:51 nospam snort[7655]: Server profile: All Nov 17 21:38:51 nospam snort[7655]: Ports: 80 8080 8180 Nov 17 21:38:51 nospam snort[7655]: Flow Depth: 300 Nov 17 21:38:51 nospam snort[7655]: Max Chunk Length: 500000 Nov 17 21:38:51 nospam snort[7655]: Inspect Pipeline Requests: YES Nov 17 21:38:51 nospam snort[7655]: URI Discovery Strict Mode: NO Nov 17 21:38:51 nospam snort[7655]: Allow Proxy Usage: NO Nov 17 21:38:51 nospam snort[7655]: Disable Alerting: NO Nov 17 21:38:51 nospam snort[7655]: Oversize Dir Length: 500 Nov 17 21:38:51 nospam snort[7655]: Only inspect URI: NO Nov 17 21:38:51 nospam snort[7655]: Ascii: YES alert: NO Nov 17 21:38:51 nospam snort[7655]: Double Decoding: YES alert: YES Nov 17 21:38:51 nospam snort[7655]: %U Encoding: YES alert: YES Nov 17 21:38:51 nospam snort[7655]: Bare Byte: YES alert: YES Nov 17 21:38:51 nospam snort[7655]: Base36: OFF Nov 17 21:38:51 nospam snort[7655]: UTF 8: OFF Nov 17 21:38:51 nospam snort[7655]: IIS Unicode: YES alert: YES Nov 17 21:38:51 nospam snort[7655]: Multiple Slash: YES alert: NO Nov 17 21:38:51 nospam snort[7655]: IIS Backslash: YES alert: NO Nov 17 21:38:51 nospam snort[7655]: Directory Traversal: YES alert: NO Nov 17 21:38:51 nospam snort[7655]: Web Root Traversal: YES alert: YES Nov 17 21:38:51 nospam snort[7655]: Apache WhiteSpace: YES alert: NO Nov 17 21:38:51 nospam snort[7655]: IIS Delimiter: YES alert: NO Nov 17 21:38:51 nospam snort[7655]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Nov 17 21:38:51 nospam snort[7655]: Non-RFC Compliant Characters: NONE Nov 17 21:38:51 nospam snort[7655]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Nov 17 21:38:51 nospam snort[7655]: rpc_decode arguments: Nov 17 21:38:51 nospam snort[7655]: Ports to decode RPC on: 111 32771 Nov 17 21:38:51 nospam snort[7655]: alert_fragments: INACTIVE Nov 17 21:38:51 nospam snort[7655]: alert_large_fragments: ACTIVE Nov 17 21:38:51 nospam snort[7655]: alert_incomplete: ACTIVE Nov 17 21:38:51 nospam snort[7655]: alert_multiple_requests: ACTIVE Nov 17 21:38:51 nospam snort[7655]: Portscan Detection Config: Nov 17 21:38:51 nospam snort[7655]: Detect Protocols: TCP UDP ICMP IP Nov 17 21:38:51 nospam snort[7655]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Nov 17 21:38:51 nospam snort[7655]: Sensitivity Level: Low Nov 17 21:38:51 nospam snort[7655]: Memcap (in bytes): 10000000 Nov 17 21:38:51 nospam snort[7655]: Number of Nodes: 26109 Nov 17 21:38:51 nospam snort[7655]: Nov 17 21:38:51 nospam snort[7655]: Tagged Packet Limit: 256 Nov 17 21:38:51 nospam snort[7655]: Nov 17 21:38:51 nospam snort[7655]: +-----------------------[thresholding-config]---------------------------------- Nov 17 21:38:51 nospam snort[7655]: | memory-cap : 1048576 bytes Nov 17 21:38:51 nospam snort[7655]: +-----------------------[thresholding-global]---------------------------------- Nov 17 21:38:51 nospam snort[7655]: | none Nov 17 21:38:51 nospam snort[7655]: +-----------------------[thresholding-local]----------------------------------- Nov 17 21:38:51 nospam snort[7655]: | none Nov 17 21:38:51 nospam snort[7655]: +-----------------------[suppression]------------------------------------------ Nov 17 21:38:51 nospam snort[7655]: | none Nov 17 21:38:51 nospam snort[7655]: ------------------------------------------------------------------------------- Nov 17 21:38:51 nospam snort[7655]: Rule application order: activation->dynamic->pass->drop->alert->log Nov 17 21:38:51 nospam snort[7655]: Log directory = /var/log/snort Nov 17 21:38:51 nospam snort[7655]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Nov 17 21:38:51 nospam snort[7655]: done Nov 17 21:38:51 nospam snort[7655]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Nov 17 21:38:51 nospam snort[7655]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Nov 17 21:38:51 nospam snort[7655]: done Nov 17 21:38:51 nospam snort[7655]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Nov 17 21:38:51 nospam snort[7655]: done Nov 17 21:38:51 nospam snort[7655]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dcerpc_preproc.so... Nov 17 21:38:51 nospam snort[7655]: done Nov 17 21:38:51 nospam snort[7655]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Nov 17 21:38:51 nospam snort[7655]: done Nov 17 21:38:51 nospam snort[7655]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Nov 17 21:38:51 nospam snort[7655]: done Nov 17 21:38:51 nospam snort[7655]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Nov 17 21:38:51 nospam snort[7655]: FTPTelnet Config: Nov 17 21:38:51 nospam snort[7655]: GLOBAL CONFIG Nov 17 21:38:51 nospam snort[7655]: Inspection Type: stateful Nov 17 21:38:51 nospam snort[7655]: Check for Encrypted Traffic: YES alert: YES Nov 17 21:38:51 nospam snort[7655]: Continue to check encrypted data: NO Nov 17 21:38:51 nospam snort[7655]: TELNET CONFIG: Nov 17 21:38:51 nospam snort[7655]: Ports: 23 Nov 17 21:38:51 nospam snort[7655]: Are You There Threshold: 200 Nov 17 21:38:51 nospam snort[7655]: Normalize: YES Nov 17 21:38:51 nospam snort[7655]: Detect Anomalies: NO Nov 17 21:38:51 nospam snort[7655]: FTP CONFIG: Nov 17 21:38:51 nospam snort[7655]: FTP Server: default Nov 17 21:38:51 nospam snort[7655]: Ports: 21 Nov 17 21:38:51 nospam snort[7655]: Check for Telnet Cmds: YES alert: YES Nov 17 21:38:51 nospam snort[7655]: Identify open data channels: YES Nov 17 21:38:51 nospam snort[7655]: FTP Client: default Nov 17 21:38:51 nospam snort[7655]: Check for Bounce Attacks: YES alert: YES Nov 17 21:38:51 nospam snort[7655]: Check for Telnet Cmds: YES alert: YES Nov 17 21:38:51 nospam snort[7655]: Max Response Length: 256 Nov 17 21:38:51 nospam snort[7655]: SMTP Config: Nov 17 21:38:51 nospam snort[7655]: Ports: Nov 17 21:38:51 nospam snort[7655]: 25 Nov 17 21:38:51 nospam snort[7655]: Nov 17 21:38:51 nospam snort[7655]: Inspection Type: STATEFUL Nov 17 21:38:51 nospam snort[7655]: Normalize Spaces: YES Nov 17 21:38:51 nospam snort[7655]: Ignore Data: NO Nov 17 21:38:51 nospam snort[7655]: Ignore TLS Data: NO Nov 17 21:38:51 nospam snort[7655]: Ignore Alerts: NO Nov 17 21:38:51 nospam snort[7655]: Max Command Length: 0 Nov 17 21:38:51 nospam snort[7655]: Max Header Line Length: 0 Nov 17 21:38:51 nospam snort[7655]: Max Response Line Length: 0 Nov 17 21:38:51 nospam snort[7655]: X-Link2State Alert: YES Nov 17 21:38:51 nospam snort[7655]: Drop on X-Link2State Alert: NO Nov 17 21:38:51 nospam snort[7655]: DCE/RPC Decoder config: Nov 17 21:38:51 nospam snort[7655]: Autodetect ports ENABLED Nov 17 21:38:51 nospam snort[7655]: SMB fragmentation ENABLED Nov 17 21:38:51 nospam snort[7655]: DCE/RPC fragmentation ENABLED Nov 17 21:38:51 nospam snort[7655]: Max Frag Size: 3000 bytes Nov 17 21:38:51 nospam snort[7655]: Memcap: 100000 KB Nov 17 21:38:51 nospam snort[7655]: Alert if memcap exceeded DISABLED Nov 17 21:38:51 nospam snort[7655]: Nov 17 21:38:51 nospam snort[7655]: DNS config: Nov 17 21:38:51 nospam snort[7655]: DNS Client rdata txt Overflow Alert: ACTIVE Nov 17 21:38:51 nospam snort[7655]: Obsolete DNS RR Types Alert: INACTIVE Nov 17 21:38:51 nospam snort[7655]: Experimental DNS RR Types Alert: INACTIVE Nov 17 21:38:51 nospam snort[7655]: Ports: Nov 17 21:38:51 nospam snort[7655]: 53 Nov 17 21:38:51 nospam snort[7655]: Nov 17 21:38:52 nospam snort[7655]: Warning: flowbits key 'community_uri.size.1050' is set but not ever checked. Nov 17 21:38:52 nospam snort[7655]: 296 out of 512 flowbits in use. Nov 17 21:38:52 nospam snort[7655]: Initializing daemon mode Nov 17 21:38:52 nospam snort[7658]: PID path stat checked out ok, PID path set to /var/run/ Nov 17 21:38:52 nospam snort[7658]: Writing PID "7658" to file "/var/run//snort_eth0.pid" Nov 17 21:38:52 nospam snort[7655]: Daemon parent exiting Nov 17 21:38:53 nospam snort[7658]: Daemon initialized, signaled parent pid: 7655 Nov 17 21:42:45 nospam snort[7658]: Preprocessor/Decoder Rule Count: 0 Nov 17 21:42:45 nospam snort[7658]: Snort initialization completed successfully (pid=7658) Nov 17 21:42:45 nospam snort[7658]: Not Using PCAP_FRAMES Nov 17 21:56:20 nospam snort[7658]: *** Caught Term-Signal Nov 17 21:56:20 nospam snort[7658]: Frag3 statistics: Nov 17 21:56:20 nospam snort[7658]: Total Fragments: 0 Nov 17 21:56:20 nospam snort[7658]: Frags Reassembled: 0 Nov 17 21:56:20 nospam snort[7658]: Discards: 0 Nov 17 21:56:20 nospam snort[7658]: Memory Faults: 0 Nov 17 21:56:20 nospam snort[7658]: Timeouts: 0 Nov 17 21:56:20 nospam snort[7658]: Overlaps: 0 Nov 17 21:56:20 nospam snort[7658]: Anomalies: 0 Nov 17 21:56:20 nospam snort[7658]: Alerts: 0 Nov 17 21:56:20 nospam snort[7658]: FragTrackers Added: 0 Nov 17 21:56:20 nospam snort[7658]: FragTrackers Dumped: 0 Nov 17 21:56:20 nospam snort[7658]: FragTrackers Auto Freed: 0 Nov 17 21:56:20 nospam snort[7658]: Frag Nodes Inserted: 0 Nov 17 21:56:20 nospam snort[7658]: Frag Nodes Deleted: 0 Nov 17 21:56:20 nospam snort[7658]: =============================================================================== Nov 17 21:56:20 nospam snort[7658]: Stream5 statistics: Nov 17 21:56:20 nospam snort[7658]: Total sessions: 11617 Nov 17 21:56:20 nospam snort[7658]: TCP sessions: 11617 Nov 17 21:56:20 nospam snort[7658]: UDP sessions: 0 Nov 17 21:56:20 nospam snort[7658]: ICMP sessions: 0 Nov 17 21:56:20 nospam snort[7658]: TCP Prunes: 0 Nov 17 21:56:20 nospam snort[7658]: UDP Prunes: 0 Nov 17 21:56:20 nospam snort[7658]: ICMP Prunes: 0 Nov 17 21:56:20 nospam snort[7658]: TCP StreamTrackers Created: 12344 Nov 17 21:56:20 nospam snort[7658]: TCP StreamTrackers Deleted: 12344 Nov 17 21:56:20 nospam snort[7658]: TCP Timeouts: 789 Nov 17 21:56:20 nospam snort[7658]: TCP Overlaps: 153 Nov 17 21:56:20 nospam snort[7658]: TCP Segments Queued: 48991 Nov 17 21:56:20 nospam snort[7658]: TCP Segments Released: 48991 Nov 17 21:56:20 nospam snort[7658]: TCP Rebuilt Packets: 29230 Nov 17 21:56:20 nospam snort[7658]: TCP Segments Used: 44312 Nov 17 21:56:20 nospam snort[7658]: TCP Discards: 21594 Nov 17 21:56:20 nospam snort[7658]: UDP Sessions Created: 0 Nov 17 21:56:20 nospam snort[7658]: UDP Sessions Deleted: 0 Nov 17 21:56:20 nospam snort[7658]: UDP Timeouts: 0 Nov 17 21:56:20 nospam snort[7658]: UDP Discards: 0 Nov 17 21:56:20 nospam snort[7658]: Events: 0 Nov 17 21:56:20 nospam snort[7658]: =============================================================================== Nov 17 21:56:20 nospam snort[7658]: Final Flow Statistics Nov 17 21:56:20 nospam snort[7658]: ,----[ FLOWCACHE STATS ]---------- Nov 17 21:56:20 nospam snort[7658]: Memcap: 10485760 Overhead Bytes 32800 used(%46.672478)/blocks (4893964/21045) Overhead blocks: 1 Could Hold: (45392) Nov 17 21:56:20 nospam snort[7658]: IPV4 count: 21044 frees: 0 low_time: 1195353765, high_time: 1195353853, diff: 0h:01:28s Nov 17 21:56:20 nospam snort[7658]: finds: 433484 reversed: 217894(%50.265754) find_success: 412440 find_fail: 21044 percent_success: (%95.145380) new_flows: 21044 Nov 17 21:56:20 nospam snort[7658]: Protocol: 1 (%0.430004) finds: 1864 reversed: 762(%40.879828) find_success: 1441 find_fail: 423 percent_success: (%77.306867) new_flows: 423 Nov 17 21:56:20 nospam snort[7658]: Protocol: 6 (%84.784906) finds: 367529 reversed: 193766(%52.721282) find_success: 353926 find_fail: 13603 percent_success: (%96.298795) new_flows: 13603 Nov 17 21:56:20 nospam snort[7658]: Protocol: 17 (%14.734800) finds: 63873 reversed: 23258(%36.412882) find_success: 56857 find_fail: 7016 percent_success: (%89.015703) new_flows: 7016 Nov 17 21:56:20 nospam snort[7658]: Protocol: 105 (%0.050290) finds: 218 reversed: 108(%49.541284) find_success: 216 find_fail: 2 percent_success: (%99.082569) new_flows: 2 Nov 17 21:56:20 nospam snort[7658]: Snort received 553950 packets Nov 17 21:56:20 nospam snort[7658]: Analyzed: 433782(78.307%) Nov 17 21:56:20 nospam snort[7658]: Dropped: 120115(21.683%) Nov 17 21:56:20 nospam snort[7658]: Outstanding: 53(0.010%) Nov 17 21:56:20 nospam snort[7658]: =============================================================================== Nov 17 21:56:20 nospam snort[7658]: Breakdown by protocol: Nov 17 21:56:20 nospam snort[7658]: TCP: 345763 (79.709%) Nov 17 21:56:20 nospam snort[7658]: UDP: 80367 (18.527%) Nov 17 21:56:20 nospam snort[7658]: ICMP: 1864 (0.430%) Nov 17 21:56:20 nospam snort[7658]: ARP: 2256 (0.520%) Nov 17 21:56:20 nospam snort[7658]: EAPOL: 0 (0.000%) Nov 17 21:56:20 nospam snort[7658]: IPv6: 0 (0.000%) Nov 17 21:56:20 nospam snort[7658]: ETHLOOP: 0 (0.000%) Nov 17 21:56:20 nospam snort[7658]: IPX: 0 (0.000%) Nov 17 21:56:20 nospam snort[7658]: FRAG: 0 (0.000%) Nov 17 21:56:20 nospam snort[7658]: OTHER: 1478 (0.341%) Nov 17 21:56:20 nospam snort[7658]: DISCARD: 2054 (0.474%) Nov 17 21:56:20 nospam snort[7658]: InvChkSum: 23958 (5.523%) Nov 17 21:56:20 nospam snort[7658]: =============================================================================== Nov 17 21:56:20 nospam snort[7658]: Action Stats: Nov 17 21:56:20 nospam snort[7658]: ALERTS: 72 Nov 17 21:56:20 nospam snort[7658]: LOGGED: 123 Nov 17 21:56:20 nospam snort[7658]: PASSED: 0 Nov 17 21:56:20 nospam snort[7658]: =============================================================================== Nov 17 21:56:20 nospam snort[7658]: HTTP Inspect - encodings (Note: stream-reassembled packets included): Nov 17 21:56:20 nospam snort[7658]: POST methods: 163 Nov 17 21:56:20 nospam snort[7658]: GET methods: 5425 Nov 17 21:56:20 nospam snort[7658]: Post parameters extracted: 1016 Nov 17 21:56:20 nospam snort[7658]: Unicode: 18 Nov 17 21:56:20 nospam snort[7658]: Double unicode: 0 Nov 17 21:56:20 nospam snort[7658]: Non-ASCII representable: 185 Nov 17 21:56:20 nospam snort[7658]: Base 36: 0 Nov 17 21:56:20 nospam snort[7658]: Directory traversals: 0 Nov 17 21:56:20 nospam snort[7658]: Extra slashes ("//"): 2189 Nov 17 21:56:20 nospam snort[7658]: Self-referencing paths ("./"): 0 Nov 17 21:56:20 nospam snort[7658]: Total packets processed: 205415 Nov 17 21:56:20 nospam snort[7658]: =============================================================================== Nov 17 21:56:20 nospam snort[7658]: Snort exiting Nov 17 21:56:20 nospam snort[7658]: Could not remove pid file /var/run//snort_eth0.pid: Permission denied Nov 17 21:56:22 nospam snort[8996]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:56:22 nospam snort[8996]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:22 nospam snort[8996]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 21:56:22 nospam snort[8996]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:22 nospam snort[8996]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:56:22 nospam snort[8996]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:56:22 nospam snort[8996]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:56:22 nospam snort[8996]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:56:22 nospam snort[8996]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:56:22 nospam snort[8996]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:56:22 nospam snort[8996]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:56:22 nospam snort[8996]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:56:22 nospam snort[8996]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:56:22 nospam snort[8996]: Var 'HOME_NET' redefined Nov 17 21:56:22 nospam snort[8996]: Var 'EXTERNAL_NET' defined, value len = 16 chars Nov 17 21:56:22 nospam snort[8996]: , value = [192.168.1.0/24] Nov 17 21:56:22 nospam snort[8996]: FATAL ERROR: /etc/snort/snort.conf(59): Bad value in variable definition! Make sure you don't have a "$" in the var name Nov 17 21:56:25 nospam snort[9011]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:56:25 nospam snort[9011]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:25 nospam snort[9011]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 21:56:25 nospam snort[9011]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:25 nospam snort[9011]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:56:25 nospam snort[9011]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:56:25 nospam snort[9011]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:56:25 nospam snort[9011]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:56:25 nospam snort[9011]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:56:25 nospam snort[9011]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:56:25 nospam snort[9011]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:56:25 nospam snort[9011]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:56:25 nospam snort[9011]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:56:25 nospam snort[9011]: Var 'HOME_NET' redefined Nov 17 21:56:25 nospam snort[9011]: Var 'EXTERNAL_NET' defined, value len = 16 chars Nov 17 21:56:25 nospam snort[9011]: , value = [192.168.1.0/24] Nov 17 21:56:25 nospam snort[9011]: FATAL ERROR: /etc/snort/snort.conf(59): Bad value in variable definition! Make sure you don't have a "$" in the var name Nov 17 21:56:49 nospam snort[9049]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:56:49 nospam snort[9049]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:49 nospam snort[9049]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 21:56:49 nospam snort[9049]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:49 nospam snort[9049]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:56:49 nospam snort[9049]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:56:49 nospam snort[9049]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:56:49 nospam snort[9049]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:56:49 nospam snort[9049]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:56:49 nospam snort[9049]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:56:49 nospam snort[9049]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:56:49 nospam snort[9049]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:56:49 nospam snort[9049]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:56:49 nospam snort[9049]: Var 'HOME_NET' redefined Nov 17 21:56:49 nospam snort[9049]: Var 'EXTERNAL_NET' defined, value len = 16 chars Nov 17 21:56:49 nospam snort[9049]: , value = [192.168.1.0/24] Nov 17 21:56:49 nospam snort[9049]: FATAL ERROR: /etc/snort/snort.conf(59): Bad value in variable definition! Make sure you don't have a "$" in the var name Nov 17 21:56:53 nospam snort[9068]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:56:53 nospam snort[9068]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:53 nospam snort[9068]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 21:56:53 nospam snort[9068]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:53 nospam snort[9068]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:56:53 nospam snort[9068]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:56:53 nospam snort[9068]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:56:53 nospam snort[9068]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:56:53 nospam snort[9068]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:56:53 nospam snort[9068]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:56:53 nospam snort[9068]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:56:53 nospam snort[9068]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:56:53 nospam snort[9068]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:56:53 nospam snort[9068]: Var 'HOME_NET' redefined Nov 17 21:56:53 nospam snort[9068]: Var 'EXTERNAL_NET' defined, value len = 16 chars Nov 17 21:56:53 nospam snort[9068]: , value = [192.168.1.0/24] Nov 17 21:56:53 nospam snort[9068]: FATAL ERROR: /etc/snort/snort.conf(59): Bad value in variable definition! Make sure you don't have a "$" in the var name Nov 17 21:56:54 nospam snort[9076]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:56:54 nospam snort[9076]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:54 nospam snort[9076]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 21:56:54 nospam snort[9076]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:56:54 nospam snort[9076]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:56:54 nospam snort[9076]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:56:54 nospam snort[9076]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:56:54 nospam snort[9076]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:56:54 nospam snort[9076]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:56:54 nospam snort[9076]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:56:54 nospam snort[9076]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:56:54 nospam snort[9076]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:56:54 nospam snort[9076]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:56:54 nospam snort[9076]: Var 'HOME_NET' redefined Nov 17 21:56:54 nospam snort[9076]: Var 'EXTERNAL_NET' defined, value len = 16 chars Nov 17 21:56:54 nospam snort[9076]: , value = [192.168.1.0/24] Nov 17 21:56:54 nospam snort[9076]: FATAL ERROR: /etc/snort/snort.conf(59): Bad value in variable definition! Make sure you don't have a "$" in the var name Nov 17 21:58:28 nospam snort[9276]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 21:58:28 nospam snort[9276]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:58:28 nospam snort[9276]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 21:58:28 nospam snort[9276]: , value = 66.228.0.0/255.255.252.0 Nov 17 21:58:28 nospam snort[9276]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 21:58:28 nospam snort[9276]: , value = 192.168.156.0/255.255.255.0 Nov 17 21:58:28 nospam snort[9276]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 21:58:28 nospam snort[9276]: , value = 192.168.150.0/255.255.255.0 Nov 17 21:58:28 nospam snort[9276]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 21:58:28 nospam snort[9276]: , value = 0.0.0.0/0.0.0.0 Nov 17 21:58:28 nospam snort[9276]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 21:58:28 nospam snort[9276]: , value = 127.0.0.0/255.0.0.0 Nov 17 21:58:28 nospam snort[9276]: Parsing Rules file /etc/snort/snort.conf Nov 17 21:58:28 nospam snort[9276]: Var 'HOME_NET' redefined Nov 17 21:58:28 nospam snort[9276]: Var 'EXTERNAL_NET' defined, value len = 16 chars Nov 17 21:58:28 nospam snort[9276]: , value = [192.168.1.0/24] Nov 17 21:58:28 nospam snort[9276]: FATAL ERROR: /etc/snort/snort.conf(59): Bad value in variable definition! Make sure you don't have a "$" in the var name Nov 17 22:04:13 nospam snort[9617]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 22:04:13 nospam snort[9617]: , value = 66.228.0.0/255.255.252.0 Nov 17 22:04:13 nospam snort[9617]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 22:04:13 nospam snort[9617]: , value = 66.228.0.0/255.255.252.0 Nov 17 22:04:13 nospam snort[9617]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 22:04:13 nospam snort[9617]: , value = 192.168.156.0/255.255.255.0 Nov 17 22:04:13 nospam snort[9617]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 22:04:13 nospam snort[9617]: , value = 192.168.150.0/255.255.255.0 Nov 17 22:04:13 nospam snort[9617]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 22:04:13 nospam snort[9617]: , value = 0.0.0.0/0.0.0.0 Nov 17 22:04:13 nospam snort[9617]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 22:04:13 nospam snort[9617]: , value = 127.0.0.0/255.0.0.0 Nov 17 22:04:13 nospam snort[9617]: Parsing Rules file /etc/snort/snort.conf Nov 17 22:04:13 nospam snort[9617]: Var 'HOME_NET' redefined Nov 17 22:04:13 nospam snort[9617]: Var 'EXTERNAL_NET' defined, value len = 16 chars Nov 17 22:04:13 nospam snort[9617]: , value = [192.168.1.0/24] Nov 17 22:04:13 nospam snort[9617]: FATAL ERROR: /etc/snort/snort.conf(59): Bad value in variable definition! Make sure you don't have a "$" in the var name Nov 17 22:04:30 nospam snort[9642]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 22:04:30 nospam snort[9642]: , value = 66.228.0.0/255.255.252.0 Nov 17 22:04:30 nospam snort[9642]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 22:04:30 nospam snort[9642]: , value = 66.228.0.0/255.255.252.0 Nov 17 22:04:30 nospam snort[9642]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 22:04:30 nospam snort[9642]: , value = 192.168.156.0/255.255.255.0 Nov 17 22:04:30 nospam snort[9642]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 22:04:30 nospam snort[9642]: , value = 192.168.150.0/255.255.255.0 Nov 17 22:04:30 nospam snort[9642]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 22:04:30 nospam snort[9642]: , value = 0.0.0.0/0.0.0.0 Nov 17 22:04:30 nospam snort[9642]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 22:04:30 nospam snort[9642]: , value = 127.0.0.0/255.0.0.0 Nov 17 22:04:30 nospam snort[9642]: Parsing Rules file /etc/snort/snort.conf Nov 17 22:04:30 nospam snort[9642]: Var 'HOME_NET' redefined Nov 17 22:04:30 nospam snort[9642]: Var 'EXTERNAL_NET' defined, value len = 16 chars Nov 17 22:04:30 nospam snort[9642]: , value = [192.168.1.0/24] Nov 17 22:04:30 nospam snort[9642]: FATAL ERROR: /etc/snort/snort.conf(59): Bad value in variable definition! Make sure you don't have a "$" in the var name Nov 17 22:08:22 nospam snort[9848]: Var 'eth0_ADDRESS' defined, value len = 24 chars Nov 17 22:08:22 nospam snort[9848]: , value = 66.228.0.0/255.255.252.0 Nov 17 22:08:22 nospam snort[9848]: Var 'eth1_ADDRESS' defined, value len = 24 chars Nov 17 22:08:22 nospam snort[9848]: , value = 66.228.0.0/255.255.252.0 Nov 17 22:08:22 nospam snort[9848]: Var 'vmnet1_ADDRESS' defined, value len = 27 chars Nov 17 22:08:22 nospam snort[9848]: , value = 192.168.156.0/255.255.255.0 Nov 17 22:08:22 nospam snort[9848]: Var 'vmnet8_ADDRESS' defined, value len = 27 chars Nov 17 22:08:22 nospam snort[9848]: , value = 192.168.150.0/255.255.255.0 Nov 17 22:08:22 nospam snort[9848]: Var 'any_ADDRESS' defined, value len = 15 chars Nov 17 22:08:22 nospam snort[9848]: , value = 0.0.0.0/0.0.0.0 Nov 17 22:08:22 nospam snort[9848]: Var 'lo_ADDRESS' defined, value len = 19 chars Nov 17 22:08:22 nospam snort[9848]: , value = 127.0.0.0/255.0.0.0 Nov 17 22:08:22 nospam snort[9848]: Parsing Rules file /etc/snort/snort.conf Nov 17 22:08:22 nospam snort[9848]: Var 'HOME_NET' redefined Nov 17 22:08:22 nospam snort[9848]: Var 'EXTERNAL_NET' defined, value len = 15 chars Nov 17 22:08:22 nospam snort[9848]: , value = 66.228.0.200/22 Nov 17 22:08:22 nospam snort[9848]: FATAL ERROR: /etc/snort/snort.conf(59): Bad value in variable definition! Make sure you don't have a "$" in the var name