All pastes #456220 Raw Edit

Untitled

public text v1 · immutable
#456220 ·published 2007-04-24 18:39 UTC
rendered paste body
Apr 24 14:30:16 huge snort[9957]: Var 'any_ADDRESS' defined, value len = 15 chars
Apr 24 14:30:16 huge snort[9957]: , value = 0.0.0.0/0.0.0.0
Apr 24 14:30:16 huge snort[9957]: Var 'lo_ADDRESS' defined, value len = 19 chars
Apr 24 14:30:16 huge snort[9957]: , value = 127.0.0.0/255.0.0.0
Apr 24 14:30:16 huge snort[9957]: Parsing Rules file /etc/snort/snort.conf
Apr 24 14:30:16 huge snort[9957]: Var 'HOME_NET' defined, value len = 3 chars
Apr 24 14:30:16 huge snort[9957]: , value = any
Apr 24 14:30:16 huge snort[9957]: Var 'EXTERNAL_NET' defined, value len = 3 chars
Apr 24 14:30:16 huge snort[9957]: , value = any
Apr 24 14:30:16 huge snort[9957]: Var 'DNS_SERVERS' defined, value len = 3 chars
Apr 24 14:30:16 huge snort[9957]: , value = any
Apr 24 14:30:16 huge snort[9957]: Var 'SMTP_SERVERS' defined, value len = 3 chars
Apr 24 14:30:16 huge snort[9957]: , value = any
Apr 24 14:30:16 huge snort[9957]: Var 'HTTP_SERVERS' defined, value len = 3 chars
Apr 24 14:30:16 huge snort[9957]: , value = any
Apr 24 14:30:16 huge snort[9957]: Var 'SQL_SERVERS' defined, value len = 3 chars
Apr 24 14:30:16 huge snort[9957]: , value = any
Apr 24 14:30:16 huge snort[9957]: Var 'TELNET_SERVERS' defined, value len = 3 chars
Apr 24 14:30:16 huge snort[9957]: , value = any
Apr 24 14:30:16 huge snort[9957]: Var 'SNMP_SERVERS' defined, value len = 3 chars
Apr 24 14:30:16 huge snort[9957]: , value = any
Apr 24 14:30:16 huge snort[9957]: Var 'HTTP_PORTS' defined, value len = 2 chars
Apr 24 14:30:16 huge snort[9957]: , value = 80
Apr 24 14:30:16 huge snort[9957]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars
Apr 24 14:30:16 huge snort[9957]: , value = !80
Apr 24 14:30:16 huge snort[9957]: Var 'ORACLE_PORTS' defined, value len = 4 chars
Apr 24 14:30:16 huge snort[9957]: , value = 1521
Apr 24 14:30:16 huge snort[9957]: Var 'AIM_SERVERS' defined, value len = 185 chars
Apr 24 14:30:16 huge snort[9957]:
Apr 24 14:30:16 huge snort[9957]:    [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9
Apr 24 14:30:16 huge snort[9957]:    .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]
Apr 24 14:30:16 huge snort[9957]: Var 'RULE_PATH' defined, value len = 16 chars
Apr 24 14:30:16 huge snort[9957]: , value = /etc/snort/rules
Apr 24 14:30:16 huge snort[9957]: ,-----------[Flow Config]----------------------
Apr 24 14:30:16 huge snort[9957]: | Stats Interval:  0
Apr 24 14:30:16 huge snort[9957]: | Hash Method:     2
Apr 24 14:30:16 huge snort[9957]: | Memcap:          10485760
Apr 24 14:30:16 huge snort[9957]: | Rows  :          4099
Apr 24 14:30:16 huge snort[9957]: | Overhead Bytes:  16400(%0.16)
Apr 24 14:30:16 huge snort[9957]: `----------------------------------------------
Apr 24 14:30:16 huge snort[9957]: Frag3 global config:
Apr 24 14:30:16 huge snort[9957]:     Max frags: 65536
Apr 24 14:30:16 huge snort[9957]:     Fragment memory cap: 4194304 bytes
Apr 24 14:30:16 huge snort[9957]: Frag3 engine config:
Apr 24 14:30:16 huge snort[9957]:     Target-based policy: FIRST
Apr 24 14:30:16 huge snort[9957]:     Fragment timeout: 60 seconds
Apr 24 14:30:16 huge snort[9957]:     Fragment min_ttl:   1
Apr 24 14:30:16 huge snort[9957]:     Fragment ttl_limit: 5
Apr 24 14:30:16 huge snort[9957]:     Fragment Problems: 1
Apr 24 14:30:16 huge snort[9957]:     Bound Addresses: 0.0.0.0/0.0.0.0
Apr 24 14:30:16 huge snort[9957]: Stream4 config:
Apr 24 14:30:16 huge snort[9957]:     Stateful inspection: ACTIVE
Apr 24 14:30:16 huge snort[9957]:     Session statistics: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     Session timeout: 30 seconds
Apr 24 14:30:16 huge snort[9957]:     Session memory cap: 8388608 bytes
Apr 24 14:30:16 huge snort[9957]:     Session count max: 8192 sessions
Apr 24 14:30:16 huge snort[9957]:     Session cleanup count: 5
Apr 24 14:30:16 huge snort[9957]:     State alerts: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     Evasion alerts: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     Scan alerts: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     Log Flushed Streams: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     MinTTL: 1
Apr 24 14:30:16 huge snort[9957]:     TTL Limit: 5
Apr 24 14:30:16 huge snort[9957]:     Async Link: 0
Apr 24 14:30:16 huge snort[9957]:     State Protection: 0
Apr 24 14:30:16 huge snort[9957]:     Self preservation threshold: 50
Apr 24 14:30:16 huge snort[9957]:     Self preservation period: 90
Apr 24 14:30:16 huge snort[9957]:     Suspend threshold: 200
Apr 24 14:30:16 huge snort[9957]:     Suspend period: 30
Apr 24 14:30:16 huge snort[9957]:     Enforce TCP State: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     Midstream Drop Alerts: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     Allow Blocking of TCP Sessions in Inline: ACTIVE
Apr 24 14:30:16 huge snort[9957]:     Server Data Inspection Limit: -1
Apr 24 14:30:16 huge snort[9957]: WARNING /etc/snort/snort.conf(439) => flush_behavior set in config file, using old static flushpoints (0)
Apr 24 14:30:16 huge snort[9957]: Stream4_reassemble config:
Apr 24 14:30:16 huge snort[9957]:     Server reassembly: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     Client reassembly: ACTIVE
Apr 24 14:30:16 huge snort[9957]:     Reassembler alerts: ACTIVE
Apr 24 14:30:16 huge snort[9957]:     Zero out flushed packets: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     Flush stream on alert: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     flush_data_diff_size: 500
Apr 24 14:30:16 huge snort[9957]:     Reassembler Packet Preferance : Favor Old
Apr 24 14:30:16 huge snort[9957]:     Packet Sequence Overlap Limit: -1
Apr 24 14:30:16 huge snort[9957]:     Flush behavior: Small (<255 bytes)
Apr 24 14:30:16 huge snort[9957]:     Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
Apr 24 14:30:16 huge snort[9957]:     Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
Apr 24 14:30:16 huge snort[9957]: HttpInspect Config:
Apr 24 14:30:16 huge snort[9957]:     GLOBAL CONFIG
Apr 24 14:30:16 huge snort[9957]:       Max Pipeline Requests:    0
Apr 24 14:30:16 huge snort[9957]:       Inspection Type:          STATELESS
Apr 24 14:30:16 huge snort[9957]:       Detect Proxy Usage:       NO
Apr 24 14:30:16 huge snort[9957]:       IIS Unicode Map Filename: /etc/snort/unicode.map
Apr 24 14:30:16 huge snort[9957]:       IIS Unicode Map Codepage: 1252
Apr 24 14:30:16 huge snort[9957]:     DEFAULT SERVER CONFIG:
Apr 24 14:30:16 huge snort[9957]:       Server profile: All
Apr 24 14:30:16 huge snort[9957]:       Ports: 80 8080 8180
Apr 24 14:30:16 huge snort[9957]:       Flow Depth: 300
Apr 24 14:30:16 huge snort[9957]:       Max Chunk Length: 500000
Apr 24 14:30:16 huge snort[9957]:       Inspect Pipeline Requests: YES
Apr 24 14:30:16 huge snort[9957]:       URI Discovery Strict Mode: NO
Apr 24 14:30:16 huge snort[9957]:       Allow Proxy Usage: NO
Apr 24 14:30:16 huge snort[9957]:       Disable Alerting: NO
Apr 24 14:30:16 huge snort[9957]:       Oversize Dir Length: 500
Apr 24 14:30:16 huge snort[9957]:       Only inspect URI: NO
Apr 24 14:30:16 huge snort[9957]:       Ascii: YES alert: NO
Apr 24 14:30:16 huge snort[9957]:       Double Decoding: YES alert: YES
Apr 24 14:30:16 huge snort[9957]:       %U Encoding: YES alert: YES
Apr 24 14:30:16 huge snort[9957]:       Bare Byte: YES alert: YES
Apr 24 14:30:16 huge snort[9957]:       Base36: OFF
Apr 24 14:30:16 huge snort[9957]:       UTF 8: OFF
Apr 24 14:30:16 huge snort[9957]:       IIS Unicode: YES alert: YES
Apr 24 14:30:16 huge snort[9957]:       Multiple Slash: YES alert: NO
Apr 24 14:30:16 huge snort[9957]:       IIS Backslash: YES alert: NO
Apr 24 14:30:16 huge snort[9957]:       Directory Traversal: YES alert: NO
Apr 24 14:30:16 huge snort[9957]:       Web Root Traversal: YES alert: YES
Apr 24 14:30:16 huge snort[9957]:       Apache WhiteSpace: YES alert: NO
Apr 24 14:30:16 huge snort[9957]:       IIS Delimiter: YES alert: NO
Apr 24 14:30:16 huge snort[9957]:       IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
Apr 24 14:30:16 huge snort[9957]:       Non-RFC Compliant Characters: NONE
Apr 24 14:30:16 huge snort[9957]:       Whitespace Characters: 0x09 0x0b 0x0c 0x0d
Apr 24 14:30:16 huge snort[9957]: rpc_decode arguments:
Apr 24 14:30:16 huge snort[9957]:     Ports to decode RPC on: 111 32771
Apr 24 14:30:16 huge snort[9957]:     alert_fragments: INACTIVE
Apr 24 14:30:16 huge snort[9957]:     alert_large_fragments: ACTIVE
Apr 24 14:30:16 huge snort[9957]:     alert_incomplete: ACTIVE
Apr 24 14:30:16 huge snort[9957]:     alert_multiple_requests: ACTIVE
Apr 24 14:30:16 huge snort[9957]: Portscan Detection Config:
Apr 24 14:30:16 huge snort[9957]:     Detect Protocols:  TCP UDP ICMP IP
Apr 24 14:30:16 huge snort[9957]:     Detect Scan Type:  portscan portsweep decoy_portscan distributed_portscan
Apr 24 14:30:16 huge snort[9957]:     Sensitivity Level: Low
Apr 24 14:30:16 huge snort[9957]:     Memcap (in bytes): 10000000
Apr 24 14:30:16 huge snort[9957]:     Number of Nodes:   36900
Apr 24 14:30:16 huge snort[9957]: