rendered paste body----------
May 8 04:50:00 darknessmind snort[18220]: | Stats Interval: 0
May 8 04:50:00 darknessmind snort[18220]: | Hash Method: 2
May 8 04:50:00 darknessmind snort[18220]: | Memcap: 10485760
May 8 04:50:00 darknessmind snort[18220]: | Rows : 4099
May 8 04:50:00 darknessmind snort[18220]: | Overhead Bytes: 16400(%0.16)
May 8 04:50:00 darknessmind snort[18220]: `----------------------------------------------
May 8 04:50:00 darknessmind snort[18220]: Frag3 global config:
May 8 04:50:00 darknessmind snort[18220]: Max frags: 65536
May 8 04:50:00 darknessmind snort[18220]: Fragment memory cap: 4194304 bytes
May 8 04:50:00 darknessmind snort[18220]: Frag3 engine config:
May 8 04:50:00 darknessmind snort[18220]: Target-based policy: FIRST
May 8 04:50:00 darknessmind snort[18220]: Fragment timeout: 60 seconds
May 8 04:50:00 darknessmind snort[18220]: Fragment min_ttl: 1
May 8 04:50:00 darknessmind snort[18220]: Fragment ttl_limit: 5
May 8 04:50:00 darknessmind snort[18220]: Fragment Problems: 1
May 8 04:50:00 darknessmind snort[18220]: Bound Addresses: 0.0.0.0/0.0.0.0
May 8 04:50:00 darknessmind snort[18220]: Stream4 config:
May 8 04:50:00 darknessmind snort[18220]: Stateful inspection: ACTIVE
May 8 04:50:00 darknessmind snort[18220]: Session statistics: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: Session timeout: 30 seconds
May 8 04:50:00 darknessmind snort[18220]: Session memory cap: 8388608 bytes
May 8 04:50:00 darknessmind snort[18220]: Session count max: 8192 sessions
May 8 04:50:00 darknessmind snort[18220]: Session cleanup count: 5
May 8 04:50:00 darknessmind snort[18220]: State alerts: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: Evasion alerts: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: Scan alerts: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: Log Flushed Streams: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: MinTTL: 1
May 8 04:50:00 darknessmind snort[18220]: TTL Limit: 5
May 8 04:50:00 darknessmind snort[18220]: Async Link: 0
May 8 04:50:00 darknessmind snort[18220]: State Protection: 0
May 8 04:50:00 darknessmind snort[18220]: Self preservation threshold: 50
May 8 04:50:00 darknessmind snort[18220]: Self preservation period: 90
May 8 04:50:00 darknessmind snort[18220]: Suspend threshold: 200
May 8 04:50:00 darknessmind snort[18220]: Suspend period: 30
May 8 04:50:00 darknessmind snort[18220]: Enforce TCP State: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: Midstream Drop Alerts: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: Server Data Inspection Limit: -1
May 8 04:50:00 darknessmind snort[18220]: WARNING /etc/snort/snort.conf(408) => flush_behavior set in config file, using old static flushpoints (0)
May 8 04:50:00 darknessmind snort[18220]: Stream4_reassemble config:
May 8 04:50:00 darknessmind snort[18220]: Server reassembly: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: Client reassembly: ACTIVE
May 8 04:50:00 darknessmind snort[18220]: Reassembler alerts: ACTIVE
May 8 04:50:00 darknessmind snort[18220]: Zero out flushed packets: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: Flush stream on alert: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: flush_data_diff_size: 500
May 8 04:50:00 darknessmind snort[18220]: Reassembler Packet Preferance : Favor Old
May 8 04:50:00 darknessmind snort[18220]: Packet Sequence Overlap Limit: -1
May 8 04:50:00 darknessmind snort[18220]: Flush behavior: Small (<255 bytes)
May 8 04:50:00 darknessmind snort[18220]: Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
May 8 04:50:00 darknessmind snort[18220]: Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
May 8 04:50:00 darknessmind snort[18220]: HttpInspect Config:
May 8 04:50:00 darknessmind snort[18220]: GLOBAL CONFIG
May 8 04:50:00 darknessmind snort[18220]: Max Pipeline Requests: 0
May 8 04:50:00 darknessmind snort[18220]: Inspection Type: STATELESS
May 8 04:50:00 darknessmind snort[18220]: Detect Proxy Usage: NO
May 8 04:50:00 darknessmind snort[18220]: IIS Unicode Map Filename: /etc/snort/unicode.map
May 8 04:50:00 darknessmind snort[18220]: IIS Unicode Map Codepage: 1252
May 8 04:50:00 darknessmind snort[18220]: DEFAULT SERVER CONFIG:
May 8 04:50:00 darknessmind snort[18220]: Ports: 80 8080 8180
May 8 04:50:00 darknessmind snort[18220]: Flow Depth: 300
May 8 04:50:00 darknessmind snort[18220]: Max Chunk Length: 500000
May 8 04:50:00 darknessmind snort[18220]: Inspect Pipeline Requests: YES
May 8 04:50:00 darknessmind snort[18220]: URI Discovery Strict Mode: NO
May 8 04:50:00 darknessmind snort[18220]: Allow Proxy Usage: NO
May 8 04:50:00 darknessmind snort[18220]: Disable Alerting: NO
May 8 04:50:00 darknessmind snort[18220]: Oversize Dir Length: 500
May 8 04:50:00 darknessmind snort[18220]: Only inspect URI: NO
May 8 04:50:00 darknessmind snort[18220]: Ascii: YES alert: NO
May 8 04:50:00 darknessmind snort[18220]: Double Decoding: YES alert: YES
May 8 04:50:00 darknessmind snort[18220]: %U Encoding: YES alert: YES
May 8 04:50:00 darknessmind snort[18220]: Bare Byte: YES alert: YES
May 8 04:50:00 darknessmind snort[18220]: Base36: OFF
May 8 04:50:00 darknessmind snort[18220]: UTF 8: OFF
May 8 04:50:00 darknessmind snort[18220]: IIS Unicode: YES alert: YES
May 8 04:50:00 darknessmind snort[18220]: Multiple Slash: YES alert: NO
May 8 04:50:00 darknessmind snort[18220]: IIS Backslash: YES alert: NO
May 8 04:50:00 darknessmind snort[18220]: Directory Traversal: YES alert: NO
May 8 04:50:00 darknessmind snort[18220]: Web Root Traversal: YES alert: YES
May 8 04:50:00 darknessmind snort[18220]: Apache WhiteSpace: YES alert: NO
May 8 04:50:00 darknessmind snort[18220]: IIS Delimiter: YES alert: NO
May 8 04:50:00 darknessmind snort[18220]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
May 8 04:50:00 darknessmind snort[18220]: Non-RFC Compliant Characters: NONE
May 8 04:50:00 darknessmind snort[18220]: rpc_decode arguments:
May 8 04:50:00 darknessmind snort[18220]: Ports to decode RPC on: 111 32771
May 8 04:50:00 darknessmind snort[18220]: alert_fragments: INACTIVE
May 8 04:50:00 darknessmind snort[18220]: alert_large_fragments: ACTIVE
May 8 04:50:00 darknessmind snort[18220]: alert_incomplete: ACTIVE
May 8 04:50:00 darknessmind snort[18220]: alert_multiple_requests: ACTIVE
May 8 04:50:00 darknessmind snort[18220]: Portscan Detection Config:
May 8 04:50:00 darknessmind snort[18220]: Detect Protocols: TCP UDP ICMP IP
May 8 04:50:00 darknessmind snort[18220]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan
May 8 04:50:00 darknessmind snort[18220]: Sensitivity Level: Low
May 8 04:50:00 darknessmind snort[18220]: Memcap (in bytes): 10000000
May 8 04:50:00 darknessmind snort[18220]: Number of Nodes: 36900
May 8 04:50:00 darknessmind snort[18220]:
May 8 04:50:00 darknessmind snort[18220]: Tagged Packet Limit: 256
May 8 04:50:00 darknessmind snort[18220]:
May 8 04:50:00 darknessmind snort[18220]: +-----------------------[thresholding-config]----------------------------------
May 8 04:50:00 darknessmind snort[18220]: | memory-cap : 1048576 bytes
May 8 04:50:00 darknessmind snort[18220]: +-----------------------[thresholding-global]----------------------------------
May 8 04:50:00 darknessmind snort[18220]: | none
May 8 04:50:00 darknessmind snort[18220]: +-----------------------[thresholding-local]-----------------------------------
May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60
May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60
May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60
May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60
May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2
May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60
May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10
May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2
May 8 04:50:00 darknessmind snort[18220]: | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60
May 8 04:50:00 darknessmind snort[18220]: +-----------------------[suppression]------------------------------------------
May 8 04:50:00 darknessmind snort[18220]: | none
May 8 04:50:00 darknessmind snort[18220]: -------------------------------------------------------------------------------
May 8 04:50:00 darknessmind snort[18220]: Rule application order: ->activation->dynamic->pass->drop->alert->log
May 8 04:50:00 darknessmind snort[18220]: Log directory = /var/log/snort
May 8 04:50:00 darknessmind snort[18220]: Loading dynamic engine /usr/lib/snort/dynamicengine/libsf_engine.so...
May 8 04:50:00 darknessmind snort[18220]: done
May 8 04:50:00 darknessmind snort[18220]: Loading all dynamic preprocessor libs from /usr/lib/snort/dynamicpreprocessor/...
May 8 04:50:00 darknessmind snort[18220]: Loading dynamic preprocessor library /usr/lib/snort/dynamicpreprocessor//libsf_ftptelnet_preproc.so...
May 8 04:50:00 darknessmind snort[18220]: done
May 8 04:50:00 darknessmind snort[18220]: Loading dynamic preprocessor library /usr/lib/snort/dynamicpreprocessor//libsf_smtp_preproc.so...
May 8 04:50:00 darknessmind snort[18220]: done
May 8 04:50:00 darknessmind snort[18220]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort/dynamicpreprocessor/
May 8 04:50:00 darknessmind snort[18220]: FTPTelnet Config:
May 8 04:50:00 darknessmind snort[18220]: GLOBAL CONFIG
May 8 04:50:00 darknessmind snort[18220]: Inspection Type: stateful
May 8 04:50:00 darknessmind snort[18220]: Check for Encrypted Traffic: YES alert: YES
May 8 04:50:00 darknessmind snort[18220]: Continue to check encrypted data: NO
May 8 04:50:00 darknessmind snort[18220]: TELNET CONFIG:
May 8 04:50:00 darknessmind snort[18220]: Ports: 23
May 8 04:50:00 darknessmind snort[18220]: Are You There Threshold: 200
May 8 04:50:00 darknessmind snort[18220]: Normalize: YES
May 8 04:50:00 darknessmind snort[18220]: FTP CONFIG:
May 8 04:50:00 darknessmind snort[18220]: FTP Server: default
May 8 04:50:00 darknessmind snort[18220]: Ports: 21
May 8 04:50:00 darknessmind snort[18220]: Check for Telnet Cmds: YES alert: YES
May 8 04:50:00 darknessmind snort[18220]: Identify open data channels: YES
May 8 04:50:00 darknessmind snort[18220]: FTP Client: default
May 8 04:50:00 darknessmind snort[18220]: Check for Bounce Attacks: YES alert: YES
May 8 04:50:00 darknessmind snort[18220]: Check for Telnet Cmds: YES alert: YES
May 8 04:50:00 darknessmind snort[18220]: Max Response Length: 256
May 8 04:50:00 darknessmind snort[18220]: SMTP Config:
May 8 04:50:00 darknessmind snort[18220]: Ports:
May 8 04:50:00 darknessmind snort[18220]: 25
May 8 04:50:00 darknessmind snort[18220]:
May 8 04:50:00 darknessmind snort[18220]: Inspection Type: STATEFUL
May 8 04:50:00 darknessmind snort[18220]: Normalize Spaces: YES
May 8 04:50:00 darknessmind snort[18220]: Ignore Data: NO
May 8 04:50:00 darknessmind snort[18220]: Ignore TLS Data: NO
May 8 04:50:00 darknessmind snort[18220]: Ignore Alerts: NO
May 8 04:50:00 darknessmind snort[18220]: Max Command Length: 0
May 8 04:50:00 darknessmind snort[18220]: Max Header Line Length: 0
May 8 04:50:00 darknessmind snort[18220]: Max Response Line Length: 0
May 8 04:50:00 darknessmind snort[18220]: X-Link2State Alert: YES
May 8 04:50:00 darknessmind snort[18220]: Drop on X-Link2State Alert: NO
May 8 04:50:00 darknessmind snort[18220]: Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked.
May 8 04:50:00 darknessmind snort[18220]: Warning: flowbits key 'realplayer.playlist' is checked but not ever set.
May 8 04:50:00 darknessmind snort[18220]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
May 8 04:50:00 darknessmind snort[18220]: Var 'eth0_ADDRESS' defined, value len = 25 chars
May 8 04:50:00 darknessmind snort[18220]: , value = 192.168.0.0/255.255.255.0
May 8 04:50:01 darknessmind snort[18220]: Initializing daemon mode
May 8 04:50:01 darknessmind snort[18221]: Var 'eth0_ADDRESS' redefined
May 8 04:50:01 darknessmind snort[18221]: PID path stat checked out ok, PID path set to /var/run/
May 8 04:50:01 darknessmind snort[18221]: Writing PID "18221" to file "/var/run//snort_eth0.pid"
May 8 04:50:01 darknessmind snort[18221]: Daemon initialized
May 8 04:50:01 darknessmind snort[18220]: Daemon parent exiting
May 8 04:50:01 darknessmind snort[18257]: Parsing Rules file /etc/snort/snort.conf
May 8 04:50:01 darknessmind snort[18257]: Var 'EXTERNAL_NET' defined, value len = 3 chars
May 8 04:50:01 darknessmind snort[18257]: , value = any
May 8 04:50:01 darknessmind snort[18257]: Var 'DNS_SERVERS' defined, value len = 3 chars
May 8 04:50:01 darknessmind snort[18257]: , value = any
May 8 04:50:01 darknessmind snort[18257]: Var 'SMTP_SERVERS' defined, value len = 3 chars
May 8 04:50:01 darknessmind snort[18257]: , value = any
May 8 04:50:01 darknessmind snort[18257]: Var 'HTTP_SERVERS' defined, value len = 3 chars
May 8 04:50:01 darknessmind snort[18257]: , value = any
May 8 04:50:01 darknessmind snort[18257]: Var 'SQL_SERVERS' defined, value len = 3 chars
May 8 04:50:01 darknessmind snort[18257]: , value = any
May 8 04:50:01 darknessmind snort[18257]: Var 'TELNET_SERVERS' defined, value len = 3 chars
May 8 04:50:01 darknessmind snort[18257]: , value = any
May 8 04:50:01 darknessmind snort[18257]: Var 'SNMP_SERVERS' defined, value len = 3 chars
May 8 04:50:01 darknessmind snort[18257]: , value = any
May 8 04:50:01 darknessmind snort[18257]: Var 'HTTP_PORTS' defined, value len = 2 chars
May 8 04:50:01 darknessmind snort[18257]: , value = 80
May 8 04:50:01 darknessmind snort[18257]: Var 'SHELLCODE_PORTS' defined, value len = 3 chars
May 8 04:50:01 darknessmind snort[18257]: , value = !80
May 8 04:50:01 darknessmind snort[18257]: Var 'ORACLE_PORTS' defined, value len = 4 chars
May 8 04:50:01 darknessmind snort[18257]: , value = 1521
May 8 04:50:01 darknessmind snort[18257]: Var 'AIM_SERVERS' defined, value len = 185 chars
May 8 04:50:01 darknessmind snort[18257]:
May 8 04:50:01 darknessmind snort[18257]: [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9
May 8 04:50:01 darknessmind snort[18257]: .0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]
May 8 04:50:01 darknessmind snort[18257]: Var 'RULE_PATH' defined, value len = 5 chars
May 8 04:50:01 darknessmind snort[18257]: , value = rules
May 8 04:50:01 darknessmind snort[18257]: ,-----------[Flow Config]----------------------
May 8 04:50:01 darknessmind snort[18257]: | Stats Interval: 0
May 8 04:50:01 darknessmind snort[18257]: | Hash Method: 2
May 8 04:50:01 darknessmind snort[18257]: | Memcap: 10485760
May 8 04:50:01 darknessmind snort[18257]: | Rows : 4099
May 8 04:50:01 darknessmind snort[18257]: | Overhead Bytes: 16400(%0.16)
May 8 04:50:01 darknessmind snort[18257]: `----------------------------------------------
May 8 04:50:01 darknessmind snort[18257]: Frag3 global config:
May 8 04:50:01 darknessmind snort[18257]: Max frags: 65536
May 8 04:50:01 darknessmind snort[18257]: Fragment memory cap: 4194304 bytes
May 8 04:50:01 darknessmind snort[18257]: Frag3 engine config:
May 8 04:50:01 darknessmind snort[18257]: Target-based policy: FIRST
May 8 04:50:01 darknessmind snort[18257]: Fragment timeout: 60 seconds
May 8 04:50:01 darknessmind snort[18257]: Fragment min_ttl: 1
May 8 04:50:01 darknessmind snort[18257]: Fragment ttl_limit: 5
May 8 04:50:01 darknessmind snort[18257]: Fragment Problems: 1
May 8 04:50:01 darknessmind snort[18257]: Bound Addresses: 0.0.0.0/0.0.0.0
May 8 04:50:01 darknessmind snort[18257]: Stream4 config:
May 8 04:50:01 darknessmind snort[18257]: Stateful inspection: ACTIVE
May 8 04:50:01 darknessmind snort[18257]: Session statistics: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: Session timeout: 30 seconds
May 8 04:50:01 darknessmind snort[18257]: Session memory cap: 8388608 bytes
May 8 04:50:01 darknessmind snort[18257]: Session count max: 8192 sessions
May 8 04:50:01 darknessmind snort[18257]: Session cleanup count: 5
May 8 04:50:01 darknessmind snort[18257]: State alerts: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: Evasion alerts: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: Scan alerts: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: Log Flushed Streams: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: MinTTL: 1
May 8 04:50:01 darknessmind snort[18257]: TTL Limit: 5
May 8 04:50:01 darknessmind snort[18257]: Async Link: 0
May 8 04:50:01 darknessmind snort[18257]: State Protection: 0
May 8 04:50:01 darknessmind snort[18257]: Self preservation threshold: 50
May 8 04:50:01 darknessmind snort[18257]: Self preservation period: 90
May 8 04:50:01 darknessmind snort[18257]: Suspend threshold: 200
May 8 04:50:01 darknessmind snort[18257]: Suspend period: 30
May 8 04:50:01 darknessmind snort[18257]: Enforce TCP State: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: Midstream Drop Alerts: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: Server Data Inspection Limit: -1
May 8 04:50:01 darknessmind snort[18257]: WARNING /etc/snort/snort.conf(408) => flush_behavior set in config file, using old static flushpoints (0)
May 8 04:50:01 darknessmind snort[18257]: Stream4_reassemble config:
May 8 04:50:01 darknessmind snort[18257]: Server reassembly: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: Client reassembly: ACTIVE
May 8 04:50:01 darknessmind snort[18257]: Reassembler alerts: ACTIVE
May 8 04:50:01 darknessmind snort[18257]: Zero out flushed packets: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: Flush stream on alert: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: flush_data_diff_size: 500
May 8 04:50:01 darknessmind snort[18257]: Reassembler Packet Preferance : Favor Old
May 8 04:50:01 darknessmind snort[18257]: Packet Sequence Overlap Limit: -1
May 8 04:50:01 darknessmind snort[18257]: Flush behavior: Small (<255 bytes)
May 8 04:50:01 darknessmind snort[18257]: Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
May 8 04:50:01 darknessmind snort[18257]: Emergency Ports: 21 23 25 42 53 80 110 111 135 136 137 139 143 445 513 1433 1521 3306
May 8 04:50:01 darknessmind snort[18257]: HttpInspect Config:
May 8 04:50:01 darknessmind snort[18257]: GLOBAL CONFIG
May 8 04:50:01 darknessmind snort[18257]: Max Pipeline Requests: 0
May 8 04:50:01 darknessmind snort[18257]: Inspection Type: STATELESS
May 8 04:50:01 darknessmind snort[18257]: Detect Proxy Usage: NO
May 8 04:50:01 darknessmind snort[18257]: IIS Unicode Map Filename: /etc/snort/unicode.map
May 8 04:50:01 darknessmind snort[18257]: IIS Unicode Map Codepage: 1252
May 8 04:50:01 darknessmind snort[18257]: DEFAULT SERVER CONFIG:
May 8 04:50:01 darknessmind snort[18257]: Ports: 80 8080 8180
May 8 04:50:01 darknessmind snort[18257]: Flow Depth: 300
May 8 04:50:01 darknessmind snort[18257]: Max Chunk Length: 500000
May 8 04:50:01 darknessmind snort[18257]: Inspect Pipeline Requests: YES
May 8 04:50:01 darknessmind snort[18257]: URI Discovery Strict Mode: NO
May 8 04:50:01 darknessmind snort[18257]: Allow Proxy Usage: NO
May 8 04:50:01 darknessmind snort[18257]: Disable Alerting: NO
May 8 04:50:01 darknessmind snort[18257]: Oversize Dir Length: 500
May 8 04:50:01 darknessmind snort[18257]: Only inspect URI: NO
May 8 04:50:01 darknessmind snort[18257]: Ascii: YES alert: NO
May 8 04:50:01 darknessmind snort[18257]: Double Decoding: YES alert: YES
May 8 04:50:01 darknessmind snort[18257]: %U Encoding: YES alert: YES
May 8 04:50:01 darknessmind snort[18257]: Bare Byte: YES alert: YES
May 8 04:50:01 darknessmind snort[18257]: Base36: OFF
May 8 04:50:01 darknessmind snort[18257]: UTF 8: OFF
May 8 04:50:01 darknessmind snort[18257]: IIS Unicode: YES alert: YES
May 8 04:50:01 darknessmind snort[18257]: Multiple Slash: YES alert: NO
May 8 04:50:01 darknessmind snort[18257]: IIS Backslash: YES alert: NO
May 8 04:50:01 darknessmind snort[18257]: Directory Traversal: YES alert: NO
May 8 04:50:01 darknessmind snort[18257]: Web Root Traversal: YES alert: YES
May 8 04:50:01 darknessmind snort[18257]: Apache WhiteSpace: YES alert: NO
May 8 04:50:01 darknessmind snort[18257]: IIS Delimiter: YES alert: NO
May 8 04:50:01 darknessmind snort[18257]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
May 8 04:50:01 darknessmind snort[18257]: Non-RFC Compliant Characters: NONE
May 8 04:50:01 darknessmind snort[18257]: rpc_decode arguments:
May 8 04:50:01 darknessmind snort[18257]: Ports to decode RPC on: 111 32771
May 8 04:50:01 darknessmind snort[18257]: alert_fragments: INACTIVE
May 8 04:50:01 darknessmind snort[18257]: alert_large_fragments: ACTIVE
May 8 04:50:01 darknessmind snort[18257]: alert_incomplete: ACTIVE
May 8 04:50:01 darknessmind snort[18257]: alert_multiple_requests: ACTIVE
May 8 04:50:02 darknessmind snort[18257]: Portscan Detection Config:
May 8 04:50:02 darknessmind snort[18257]: Detect Protocols: TCP UDP ICMP IP
May 8 04:50:02 darknessmind snort[18257]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan
May 8 04:50:02 darknessmind snort[18257]: Sensitivity Level: Low
May 8 04:50:02 darknessmind snort[18257]: Memcap (in bytes): 10000000
May 8 04:50:02 darknessmind snort[18257]: Number of Nodes: 36900
May 8 04:50:02 darknessmind snort[18257]:
May 8 04:50:02 darknessmind snort[18257]: Tagged Packet Limit: 256
May 8 04:50:02 darknessmind snort[18257]:
May 8 04:50:02 darknessmind snort[18257]: +-----------------------[thresholding-config]----------------------------------
May 8 04:50:02 darknessmind snort[18257]: | memory-cap : 1048576 bytes
May 8 04:50:02 darknessmind snort[18257]: +-----------------------[thresholding-global]----------------------------------
May 8 04:50:02 darknessmind snort[18257]: | none
May 8 04:50:02 darknessmind snort[18257]: +-----------------------[thresholding-local]-----------------------------------
May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2494 type=Both tracking=dst count=20 seconds=60
May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds=60
May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds=2
May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2496 type=Both tracking=dst count=20 seconds=60
May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2923 type=Threshold tracking=dst count=10 seconds=60
May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds=10
May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2495 type=Both tracking=dst count=20 seconds=60
May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=2924 type=Threshold tracking=dst count=10 seconds=60
May 8 04:50:02 darknessmind snort[18257]: | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds=2
May 8 04:50:02 darknessmind snort[18257]: +-----------------------[suppression]------------------------------------------
May 8 04:50:02 darknessmind snort[18257]: | none
May 8 04:50:02 darknessmind snort[18257]: -------------------------------------------------------------------------------
May 8 04:50:02 darknessmind snort[18257]: Rule application order: ->activation->dynamic->pass->drop->alert->log
May 8 04:50:02 darknessmind snort[18257]: Log directory = /var/log/snort
May 8 04:50:02 darknessmind snort[18257]: Loading dynamic engine /usr/lib/snort/dynamicengine/libsf_engine.so...
May 8 04:50:02 darknessmind snort[18257]: done
May 8 04:50:02 darknessmind snort[18257]: Loading all dynamic preprocessor libs from /usr/lib/snort/dynamicpreprocessor/...
May 8 04:50:02 darknessmind snort[18257]: Loading dynamic preprocessor library /usr/lib/snort/dynamicpreprocessor//libsf_ftptelnet_preproc.so...
May 8 04:50:02 darknessmind snort[18257]: done
May 8 04:50:02 darknessmind snort[18257]: Loading dynamic preprocessor library /usr/lib/snort/dynamicpreprocessor//libsf_smtp_preproc.so...
May 8 04:50:02 darknessmind snort[18257]: done
May 8 04:50:02 darknessmind snort[18257]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort/dynamicpreprocessor/
May 8 04:50:02 darknessmind snort[18257]: FTPTelnet Config:
May 8 04:50:02 darknessmind snort[18257]: GLOBAL CONFIG
May 8 04:50:02 darknessmind snort[18257]: Inspection Type: stateful
May 8 04:50:02 darknessmind snort[18257]: Check for Encrypted Traffic: YES alert: YES
May 8 04:50:02 darknessmind snort[18257]: Continue to check encrypted data: NO
May 8 04:50:02 darknessmind snort[18257]: TELNET CONFIG:
May 8 04:50:02 darknessmind snort[18257]: Ports: 23
May 8 04:50:02 darknessmind snort[18257]: Are You There Threshold: 200
May 8 04:50:02 darknessmind snort[18257]: Normalize: YES
May 8 04:50:02 darknessmind snort[18257]: FTP CONFIG:
May 8 04:50:02 darknessmind snort[18257]: FTP Server: default
May 8 04:50:02 darknessmind snort[18257]: Ports: 21
May 8 04:50:02 darknessmind snort[18257]: Check for Telnet Cmds: YES alert: YES
May 8 04:50:02 darknessmind snort[18257]: Identify open data channels: YES
May 8 04:50:02 darknessmind snort[18257]: FTP Client: default
May 8 04:50:02 darknessmind snort[18257]: Check for Bounce Attacks: YES alert: YES
May 8 04:50:02 darknessmind snort[18257]: Check for Telnet Cmds: YES alert: YES
May 8 04:50:02 darknessmind snort[18257]: Max Response Length: 256
May 8 04:50:02 darknessmind snort[18257]: SMTP Config:
May 8 04:50:02 darknessmind snort[18257]: Ports:
May 8 04:50:02 darknessmind snort[18257]: 25
May 8 04:50:02 darknessmind snort[18257]:
May 8 04:50:02 darknessmind snort[18257]: Inspection Type: STATEFUL
May 8 04:50:02 darknessmind snort[18257]: Normalize Spaces: YES
May 8 04:50:02 darknessmind snort[18257]: Ignore Data: NO
May 8 04:50:02 darknessmind snort[18257]: Ignore TLS Data: NO
May 8 04:50:02 darknessmind snort[18257]: Ignore Alerts: NO
May 8 04:50:02 darknessmind snort[18257]: Max Command Length: 0
May 8 04:50:02 darknessmind snort[18257]: Max Header Line Length: 0
May 8 04:50:02 darknessmind snort[18257]: Max Response Line Length: 0
May 8 04:50:02 darknessmind snort[18257]: X-Link2State Alert: YES
May 8 04:50:02 darknessmind snort[18257]: Drop on X-Link2State Alert: NO
May 8 04:50:02 darknessmind snort[18257]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
May 8 04:50:02 darknessmind snort[18257]: Warning: flowbits key 'smb.tree.create.llsrpc' is set but not ever checked.
May 8 04:50:02 darknessmind snort[18257]: Warning: flowbits key 'realplayer.playlist' is checked but not ever set.
May 8 04:50:02 darknessmind snort[18257]: Var 'eth0_ADDRESS' defined, value len = 25 chars
May 8 04:50:02 darknessmind snort[18257]: , value = 192.168.0.0/255.255.255.0
May 8 04:50:02 darknessmind snort[18257]: Initializing daemon mode
May 8 04:50:02 darknessmind snort[18258]: Var 'eth0_ADDRESS' redefined
May 8 04:50:02 darknessmind snort[18258]: PID path stat checked out ok, PID path set to /var/run/
May 8 04:50:02 darknessmind snort[18258]: Writing PID "18258" to file "/var/run//snort_eth0.pid"
May 8 04:50:02 darknessmind snort[18258]: Daemon initialized
May 8 04:50:02 darknessmind snort[18257]: Daemon parent exiting
[root@darknessmind var]# ll -h /var/log/daemons/
total 39M
-rw------- 1 root root 1,2M mai 8 20:13 errors.1
-rw------- 1 root root 38M mai 8 04:50 info.1
-rw------- 1 root root 297 mai 7 09:35 warnings.1