rendered paste body
Feb 14 15:29:44 moatmonster sshd[9787]: Accepted keyboard-interactive/pam for root from 192.168.0.43 port 2641 ssh2
Feb 14 15:29:44 moatmonster sshd(pam_unix)[9792]: session opened for user root by root(uid=0)
Feb 14 15:30:01 moatmonster cron[9797]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )
Feb 14 15:30:02 moatmonster barnyard[9642]: Exiting
Feb 14 15:38:46 moatmonster sshd[9881]: Accepted keyboard-interactive/pam for root from 192.168.0.245 port 34399 ssh2
Feb 14 15:38:46 moatmonster sshd(pam_unix)[9886]: session opened for user root by root(uid=0)
Feb 14 15:40:01 moatmonster cron[9895]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )
Feb 14 15:50:01 moatmonster cron[9921]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )
Feb 14 15:50:46 moatmonster sshd[9932]: Accepted keyboard-interactive/pam for root from 192.168.0.43 port 2721 ssh2
Feb 14 15:50:46 moatmonster sshd(pam_unix)[9937]: session opened for user root by root(uid=0)
Feb 14 16:00:01 moatmonster cron[9950]: (root) CMD (test -x /usr/sbin/run-crons && /usr/sbin/run-crons )
Feb 14 16:00:01 moatmonster cron[9952]: (root) CMD (rm -f /var/spool/cron/lastrun/cron.hourly)
Feb 14 16:00:10 moatmonster snort[9359]: Final Flow Statistics
Feb 14 16:00:10 moatmonster snort[9359]: Frag3 statistics:
Feb 14 16:00:10 moatmonster snort[9359]: Total Fragments: 2
Feb 14 16:00:10 moatmonster snort[9359]: Frags Reassembled: 1
Feb 14 16:00:10 moatmonster snort[9359]: Discards: 0
Feb 14 16:00:10 moatmonster snort[9359]: Memory Faults: 0
Feb 14 16:00:10 moatmonster snort[9359]: Timeouts: 0
Feb 14 16:00:10 moatmonster snort[9359]: Overlaps: 0
Feb 14 16:00:10 moatmonster snort[9359]: Anomalies: 0
Feb 14 16:00:10 moatmonster snort[9359]: Alerts: 0
Feb 14 16:00:10 moatmonster snort[9359]: FragTrackers Added: 1
Feb 14 16:00:10 moatmonster snort[9359]: FragTrackers Dumped: 1
Feb 14 16:00:10 moatmonster snort[9359]: FragTrackers Auto Freed: 0
Feb 14 16:00:10 moatmonster snort[9359]: Frag Nodes Inserted: 2
Feb 14 16:00:10 moatmonster snort[9359]: Frag Nodes Deleted: 2
Feb 14 16:00:10 moatmonster snort[9359]: ===============================================================================
Feb 14 16:00:10 moatmonster device eth0 left promiscuous mode
Feb 14 16:00:10 moatmonster audit(1171486810.651:9): dev=eth0 prom=0 old_prom=256 auid=4294967295
Feb 14 16:00:10 moatmonster snort[9359]: Snort exiting
Feb 14 16:00:10 moatmonster device eth0 entered promiscuous mode
Feb 14 16:00:10 moatmonster audit(1171486810.815:10): dev=eth0 prom=256 old_prom=0 auid=4294967295
Feb 14 16:00:10 moatmonster snort: OpenPcap() device eth0 network lookup: eth0: no IPv4 address assigned
Feb 14 16:00:10 moatmonster snort[10031]: Initializing daemon mode
Feb 14 16:00:10 moatmonster snort[10032]: PID path stat checked out ok, PID path set to /var/run/
Feb 14 16:00:10 moatmonster snort[10032]: Writing PID "10032" to file "/var/run//snort_eth0.pid"
Feb 14 16:00:10 moatmonster snort[10032]: Parsing Rules file /etc/snort/snort.conf
Feb 14 16:00:10 moatmonster snort[10032]: ,-----------[Flow Config]----------------------
Feb 14 16:00:10 moatmonster snort[10032]: | Stats Interval: 0
Feb 14 16:00:10 moatmonster snort[10032]: | Hash Method: 2
Feb 14 16:00:10 moatmonster snort[10032]: | Memcap: 10485760
Feb 14 16:00:10 moatmonster snort[10032]: | Rows : 4099
Feb 14 16:00:10 moatmonster snort[10032]: | Overhead Bytes: 16400(%0.16)
Feb 14 16:00:10 moatmonster snort[10032]: `----------------------------------------------
Feb 14 16:00:10 moatmonster snort[10032]: Frag3 global config:
Feb 14 16:00:10 moatmonster snort[10032]: Max frags: 65536
Feb 14 16:00:10 moatmonster snort[10032]: Fragment memory cap: 4194304 bytes
Feb 14 16:00:10 moatmonster snort[10032]: Frag3 engine config:
Feb 14 16:00:10 moatmonster snort[10032]: Target-based policy: FIRST
Feb 14 16:00:10 moatmonster snort[10032]: Fragment timeout: 60 seconds
Feb 14 16:00:10 moatmonster snort[10032]: Fragment min_ttl: 1
Feb 14 16:00:10 moatmonster snort[10032]: Fragment ttl_limit: 5
Feb 14 16:00:10 moatmonster snort[10032]: Fragment Problems: 1
Feb 14 16:00:10 moatmonster snort[10032]: Bound Addresses: 0.0.0.0/0.0.0.0
Feb 14 16:00:10 moatmonster snort[10032]: Stream4 config:
Feb 14 16:00:10 moatmonster snort[10032]: Stateful inspection: ACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Session statistics: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Session timeout: 30 seconds
Feb 14 16:00:10 moatmonster snort[10032]: Session memory cap: 8388608 bytes
Feb 14 16:00:10 moatmonster snort[10032]: Session count max: 8192 sessions
Feb 14 16:00:10 moatmonster snort[10032]: Session cleanup count: 5
Feb 14 16:00:10 moatmonster snort[10032]: State alerts: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Evasion alerts: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Scan alerts: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Log Flushed Streams: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: MinTTL: 1
Feb 14 16:00:10 moatmonster snort[10032]: TTL Limit: 5
Feb 14 16:00:10 moatmonster snort[10032]: Async Link: 0
Feb 14 16:00:10 moatmonster snort[10032]: State Protection: 0
Feb 14 16:00:10 moatmonster snort[10032]: Self preservation threshold: 50
Feb 14 16:00:10 moatmonster snort[10032]: Self preservation period: 90
Feb 14 16:00:10 moatmonster snort[10032]: Suspend threshold: 200
Feb 14 16:00:10 moatmonster snort[10032]: Suspend period: 30
Feb 14 16:00:10 moatmonster snort[10032]: Enforce TCP State: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Midstream Drop Alerts: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Server Data Inspection Limit: -1
Feb 14 16:00:10 moatmonster snort[10032]: WARNING /etc/snort/snort.conf(372) => flush_behavior set in config file, using old static flushpoints (0)
Feb 14 16:00:10 moatmonster snort[10032]: Stream4_reassemble config:
Feb 14 16:00:10 moatmonster snort[10032]: Server reassembly: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Client reassembly: ACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Reassembler alerts: ACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Zero out flushed packets: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Flush stream on alert: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: flush_data_diff_size: 500
Feb 14 16:00:10 moatmonster snort[10032]: Reassembler Packet Preferance : Favor Old
Feb 14 16:00:10 moatmonster snort[10032]: Packet Sequence Overlap Limit: -1
Feb 14 16:00:10 moatmonster snort[10032]: Flush behavior: Small (<255 bytes)
Feb 14 16:00:10 moatmonster snort[10032]: Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
Feb 14 16:00:10 moatmonster snort[10032]: Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
Feb 14 16:00:10 moatmonster snort[10032]: WARNING /etc/snort/snort.conf(373) => flush_behavior set in config file, using old static flushpoints (0)
Feb 14 16:00:10 moatmonster snort[10032]: Stream4_reassemble config:
Feb 14 16:00:10 moatmonster snort[10032]: Server reassembly: ACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Client reassembly: ACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Reassembler alerts: ACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Zero out flushed packets: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: Flush stream on alert: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: flush_data_diff_size: 500
Feb 14 16:00:10 moatmonster snort[10032]: Reassembler Packet Preferance : Favor Old
Feb 14 16:00:10 moatmonster snort[10032]: Packet Sequence Overlap Limit: -1
Feb 14 16:00:10 moatmonster snort[10032]: Flush behavior: Small (<255 bytes)
Feb 14 16:00:10 moatmonster snort[10032]: Ports: 21 23 25 53 80 110 111 139 143 445 513 1433
Feb 14 16:00:10 moatmonster snort[10032]: Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
Feb 14 16:00:10 moatmonster snort[10032]: HttpInspect Config:
Feb 14 16:00:10 moatmonster snort[10032]: GLOBAL CONFIG
Feb 14 16:00:10 moatmonster snort[10032]: Max Pipeline Requests: 0
Feb 14 16:00:10 moatmonster snort[10032]: Inspection Type: STATELESS
Feb 14 16:00:10 moatmonster snort[10032]: Detect Proxy Usage: NO
Feb 14 16:00:10 moatmonster snort[10032]: IIS Unicode Map Filename: /etc/snort/unicode.map
Feb 14 16:00:10 moatmonster snort[10032]: IIS Unicode Map Codepage: 1252
Feb 14 16:00:10 moatmonster snort[10032]: rpc_decode arguments:
Feb 14 16:00:10 moatmonster snort[10032]: Ports to decode RPC on: 111 32771
Feb 14 16:00:10 moatmonster snort[10032]: alert_fragments: INACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: alert_large_fragments: ACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: alert_incomplete: ACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: alert_multiple_requests: ACTIVE
Feb 14 16:00:10 moatmonster snort[10032]: telnet_decode arguments:
Feb 14 16:00:10 moatmonster snort[10032]: Ports to decode telnet on: 21 23 25 119
Feb 14 16:00:10 moatmonster snort[10032]: Portscan Detection Config:
Feb 14 16:00:10 moatmonster snort[10032]: Detect Protocols: TCP UDP ICMP IP
Feb 14 16:00:10 moatmonster snort[10032]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan
Feb 14 16:00:10 moatmonster snort[10032]: Sensitivity Level: Low
Feb 14 16:00:10 moatmonster snort[10032]: Memcap (in bytes): 10000000
Feb 14 16:00:10 moatmonster snort[10032]: Number of Nodes: 36900
Feb 14 16:00:10 moatmonster snort[10032]:
Feb 14 16:00:10 moatmonster snort[10032]: X-Link2State Config:
Feb 14 16:00:10 moatmonster snort[10032]: Ports: 25 691
Feb 14 16:00:11 moatmonster snort[10032]: Warning: flowbits key 'dce.bind.netware_cs' is checked but not ever set.
Feb 14 16:00:11 moatmonster snort[10032]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
Feb 14 16:00:11 moatmonster snort[10032]: Warning: flowbits key 'realplayer.playlist' is checked but not ever set.
Feb 14 16:00:11 moatmonster snort[10032]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked.
Feb 14 16:00:11 moatmonster snort[10032]:
Feb 14 16:00:11 moatmonster snort[10032]: +-----------------------[thresholding-config]----------------------------------
Feb 14 16:00:11 moatmonster snort[10032]: | memory-cap : 1048576 bytes
Feb 14 16:00:11 moatmonster snort[10032]: +-----------------------[thresholding-global]----------------------------------
Feb 14 16:00:11 moatmonster snort[10032]: | none
Feb 14 16:00:11 moatmonster snort[10032]: +-----------------------[thresholding-local]-----------------------------------
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=5322 type=Limit tracking=src count=1 seconds=60
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3543 type=Threshold tracking=src count=5 seconds=2
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=5321 type=Limit tracking=src count=1 seconds=60
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=5323 type=Limit tracking=src count=1 seconds=60
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=4984 type=Threshold tracking=src count=5 seconds=2
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3527 type=Limit tracking=dst count=5 seconds=60
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60
Feb 14 16:00:11 moatmonster snort[10032]: | gen-id=1 sig-id=3542 type=Threshold tracking=src count=5 seconds=2
Feb 14 16:00:11 moatmonster snort[10032]: +-----------------------[suppression]------------------------------------------
Feb 14 16:00:11 moatmonster snort[10032]: | none
Feb 14 16:00:11 moatmonster snort[10032]: -------------------------------------------------------------------------------
Feb 14 16:00:11 moatmonster snort[10032]: Rule application order: ->activation->dynamic->drop->alert->pass->log
Feb 14 16:00:11 moatmonster snort[10032]: Log directory = /var/log/snort
Feb 14 16:00:11 moatmonster snort[10032]: Snort initialization completed successfully (pid=10032)