Jul 18 17:44:12 b0x prelude-manager: - Regenerated 1024 bits Diffie-Hellman key for TLS. Jul 18 20:00:13 b0x snort[3115]: Ascii: YES alert: NO Jul 18 20:00:13 b0x snort[3115]: Double Decoding: YES alert: YES Jul 18 20:00:13 b0x snort[3115]: %U Encoding: YES alert: YES Jul 18 20:00:13 b0x snort[3115]: Bare Byte: YES alert: YES Jul 18 20:00:13 b0x snort[3115]: Base36: OFF Jul 18 20:00:13 b0x snort[3115]: UTF 8: OFF Jul 18 20:00:13 b0x snort[3115]: IIS Unicode: YES alert: YES Jul 18 20:00:13 b0x snort[3115]: Multiple Slash: YES alert: NO Jul 18 20:00:13 b0x snort[3115]: IIS Backslash: YES alert: NO Jul 18 20:00:13 b0x snort[3115]: Directory Traversal: YES alert: NO Jul 18 20:00:13 b0x snort[3115]: Web Root Traversal: YES alert: YES Jul 18 20:00:13 b0x snort[3115]: Apache WhiteSpace: YES alert: NO Jul 18 20:00:13 b0x snort[3115]: IIS Delimiter: YES alert: NO Jul 18 20:00:13 b0x snort[3115]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Jul 18 20:00:13 b0x snort[3115]: Non-RFC Compliant Characters: NONE Jul 18 20:00:13 b0x snort[3115]: rpc_decode arguments: Jul 18 20:00:13 b0x snort[3115]: Ports to decode RPC on: 111 32771 Jul 18 20:00:13 b0x snort[3115]: alert_fragments: INACTIVE Jul 18 20:00:13 b0x snort[3115]: alert_large_fragments: ACTIVE Jul 18 20:00:13 b0x snort[3115]: alert_incomplete: ACTIVE Jul 18 20:00:13 b0x snort[3115]: alert_multiple_requests: ACTIVE Jul 18 20:00:13 b0x snort[3115]: telnet_decode arguments: Jul 18 20:00:13 b0x snort[3115]: Ports to decode telnet on: 21 23 25 119 Jul 18 20:00:13 b0x snort[3115]: Portscan Detection Config: Jul 18 20:00:13 b0x snort[3115]: Detect Protocols: TCP UDP ICMP IP Jul 18 20:00:13 b0x snort[3115]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Jul 18 20:00:13 b0x snort[3115]: Sensitivity Level: Low Jul 18 20:00:13 b0x snort[3115]: Memcap (in bytes): 10000000 Jul 18 20:00:13 b0x snort[3115]: Number of Nodes: 36900 Jul 18 20:00:13 b0x snort[3115]: Jul 18 20:00:13 b0x snort[3115]: X-Link2State Config: Jul 18 20:00:13 b0x snort[3115]: Ports: 25 691 Jul 18 20:00:16 b0x snort[3115]: Warning: flowbits key 'realplayer.playlist' is checked but not ever set. Jul 18 20:00:16 b0x snort[3115]: Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked. Jul 18 20:00:16 b0x snort[3115]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set. Jul 18 20:00:16 b0x snort[3115]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked. Jul 18 20:00:16 b0x snort[3115]: Jul 18 20:00:16 b0x snort[3115]: +-----------------------[thresholding-config]---------------------------------- Jul 18 20:00:16 b0x snort[3115]: | memory-cap : 1048576 bytes Jul 18 20:00:16 b0x snort[3115]: +-----------------------[thresholding-global]---------------------------------- Jul 18 20:00:16 b0x snort[3115]: | none Jul 18 20:00:16 b0x snort[3115]: +-----------------------[thresholding-local]----------------------------------- Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3543 type=Threshold tracking=src count=5 seconds=2 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3542 type=Threshold tracking=src count=5 seconds=2 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10 Jul 18 20:00:16 b0x snort[3115]: | gen-id=1 sig-id=3527 type=Limit tracking=dst count=5 seconds=60 Jul 18 20:00:16 b0x snort[3115]: +-----------------------[suppression]------------------------------------------ Jul 18 20:00:16 b0x snort[3115]: | none Jul 18 20:00:16 b0x snort[3115]: ------------------------------------------------------------------------------- Jul 18 20:00:16 b0x snort[3115]: Rule application order: ->activation->dynamic->drop->alert->pass->log Jul 18 20:00:16 b0x snort[3115]: Log directory = /var/log/snort Jul 18 20:00:16 b0x snort[3115]: FATAL ERROR: prelude-failover: Unable to initialize prelude client: Permission denied. Jul 18 20:00:16 b0x device eth0 left promiscuous mode Jul 18 20:00:16 b0x audit(1153245616.388:61): dev=eth0 prom=0 old_prom=256 auid=4294967295