RE: how do i read this IDS log?

From: Beauford, Jason (jbeauford_at_EightInOnePet.com)
Date: 11/29/04

Next message: James Derieg: "POCKET-PC: HOW TO SECURE ACCESS FROM A POCKET PC OUTSIDE TO A SERVER IN THE LAN"

Previous message: Chris Merkel: "RE: Windows Messenger Pop-up spam"
Maybe in reply to: Rino Mardo: "how do i read this IDS log?"
Next in thread: David Gillett: "RE: how do i read this IDS log?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Mon, 29 Nov 2004 16:50:22 -0500
To: "Rino Mardo" <joroxx@gmail.com>, <security-basics@securityfocus.com>

One of these SNMP sig's by chance?

http://www.snort.org/cgi-bin/done.cgi?offset=1100

I'm sure there are more on that list.

The different ports may just be a result of the program using ephemeral
ports. However, the ports used may be a signature to the scanner. If
you dig enough you may be able to identify the scanner used and then
protect against it using prevention rules.

JMB

-----Original Message-----
From: Rino Mardo [mailto:joroxx@gmail.com]
Sent: Sunday, November 28, 2004 6:46 AM
To: security-basics@securityfocus.com
Subject: how do i read this IDS log?

folks, i have collected a small IDS log from my network. although i can
somehow interpret that it seems to be an snmp vulnerability scan, i
can't seem to figure out why the source ip is using different ports.
appreciate your help on this.

here is the complete scan:

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+

11/22-10:19:32.187608 xx.xx.xx.xx:1630 -> 255.255.255.255:161 UDP
TTL:128 TOS:0x0 ID:1998 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02
01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01
02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05
00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09
2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01
02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19
03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B
......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04
........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06
..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B
...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B
............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+

11/22-10:19:32.891551 xx.xx.xx.xx:1630 -> 255.255.255.255:161 UDP
TTL:128 TOS:0x0 ID:2146 IpLen:20 DgmLen:267
Len: 239
30 81 EC 02 01 00 04 08 69 6E 74 65 72 6E 61 6C 0.......internal A1 81
DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 ............0..0 0B 06 07 2B
06 01 02 01 01 01 05 00 30 0B 06 07 ...+........0... 2B 06 01 02 01 01
03 05 00 30 0B 06 07 2B 06 01 +........0...+.. 02 01 01 05 05 00 30 0D
06 09 2B 06 01 02 01 02 ......0...+..... 02 01 06 05 00 30 0D 06 09 2B
06 01 02 01 04 14 .....0...+...... 01 01 05 00 30 0E 06 0A 2B 06 01 02
01 19 03 02 ....0...+....... 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B
02 03 ....0...+....... 09 01 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B
......0...+..... 02 03 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04
........0...+... 01 0B 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06
..........0...+. 01 04 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B
............0... 2B 06 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06
+............0.. 0B 2B 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F
.+............0.
06 0B 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 ..+............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+

11/22-10:19:33.357811 xx.xx.xx.xx:1630 -> 255.255.255.255:161 UDP
TTL:128 TOS:0x0 ID:2184 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02
01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01
02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05
00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09
2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01
02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19
03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B
......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04
........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06
..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B
...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B
............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+

11/22-10:20:01.592360 xx.xx.xx.xx:1914 -> 255.255.255.255:161 UDP
TTL:128 TOS:0x0 ID:2970 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02
01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01
02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05
00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09
2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01
02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19
03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B
......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04
........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06
..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B
...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B
............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+

11/22-10:20:03.127504 xx.xx.xx.xx:1914 -> 255.255.255.255:161 UDP
TTL:128 TOS:0x0 ID:3093 IpLen:20 DgmLen:267
Len: 239
30 81 EC 02 01 00 04 08 69 6E 74 65 72 6E 61 6C 0.......internal A1 81
DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 ............0..0 0B 06 07 2B
06 01 02 01 01 01 05 00 30 0B 06 07 ...+........0... 2B 06 01 02 01 01
03 05 00 30 0B 06 07 2B 06 01 +........0...+.. 02 01 01 05 05 00 30 0D
06 09 2B 06 01 02 01 02 ......0...+..... 02 01 06 05 00 30 0D 06 09 2B
06 01 02 01 04 14 .....0...+...... 01 01 05 00 30 0E 06 0A 2B 06 01 02
01 19 03 02 ....0...+....... 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B
02 03 ....0...+....... 09 01 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B
......0...+..... 02 03 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04
........0...+... 01 0B 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06
..........0...+. 01 04 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B
............0... 2B 06 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06
+............0.. 0B 2B 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F
.+............0.
06 0B 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 ..+............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+

11/22-10:20:03.191711 xx.xx.xx.xx:1914 -> 255.255.255.255:161 UDP
TTL:128 TOS:0x0 ID:3095 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02
01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01
02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05
00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09
2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01
02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19
03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B
......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04
........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06
..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B
...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B
............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+

11/22-10:21:38.373587 xx.xx.xx.xx:2587 -> 255.255.255.255:161 UDP
TTL:128 TOS:0x0 ID:4790 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02
01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01
02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05
00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09
2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01
02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19
03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B
......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04
........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06
..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B
...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B
............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+

11/22-10:21:39.142089 xx.xx.xx.xx:2587 -> 255.255.255.255:161 UDP
TTL:128 TOS:0x0 ID:4798 IpLen:20 DgmLen:267
Len: 239
30 81 EC 02 01 00 04 08 69 6E 74 65 72 6E 61 6C 0.......internal A1 81
DC 02 01 00 02 01 00 02 01 00 30 81 D0 30 ............0..0 0B 06 07 2B
06 01 02 01 01 01 05 00 30 0B 06 07 ...+........0... 2B 06 01 02 01 01
03 05 00 30 0B 06 07 2B 06 01 +........0...+.. 02 01 01 05 05 00 30 0D
06 09 2B 06 01 02 01 02 ......0...+..... 02 01 06 05 00 30 0D 06 09 2B
06 01 02 01 04 14 .....0...+...... 01 01 05 00 30 0E 06 0A 2B 06 01 02
01 19 03 02 ....0...+....... 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B
02 03 ....0...+....... 09 01 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B
......0...+..... 02 03 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04
........0...+... 01 0B 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06
..........0...+. 01 04 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B
............0... 2B 06 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06
+............0.. 0B 2B 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F
.+............0.
06 0B 2B 06 01 04 01 0B 02 04 03 0D 01 05 00 ..+............

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
=+

11/22-10:21:39.873510 xx.xx.xx.xx:2587 -> 255.255.255.255:161 UDP
TTL:128 TOS:0x0 ID:4800 IpLen:20 DgmLen:265
Len: 237
30 81 EA 02 01 00 04 06 70 75 62 6C 69 63 A1 81 0.......public.. DC 02
01 00 02 01 00 02 01 00 30 81 D0 30 0B 06 ..........0..0.. 07 2B 06 01
02 01 01 01 05 00 30 0B 06 07 2B 06 .+........0...+. 01 02 01 01 03 05
00 30 0B 06 07 2B 06 01 02 01 .......0...+.... 01 05 05 00 30 0D 06 09
2B 06 01 02 01 02 02 01 ....0...+....... 06 05 00 30 0D 06 09 2B 06 01
02 01 04 14 01 01 ...0...+........ 05 00 30 0E 06 0A 2B 06 01 02 01 19
03 02 01 03 ..0...+......... 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
09 01 ..0...+......... 01 07 05 00 30 10 06 0C 2B 06 01 04 01 0B 02 03
....0...+....... 09 05 01 03 05 00 30 10 06 0C 2B 06 01 04 01 0B
......0...+..... 02 04 03 08 03 02 05 00 30 10 06 0C 2B 06 01 04
........0...+... 01 0B 02 04 03 08 03 03 05 00 30 0F 06 0B 2B 06
..........0...+. 01 04 01 0B 02 04 03 0A 07 05 00 30 0F 06 0B 2B
...........0...+ 06 01 04 01 0B 02 04 03 0A 0D 05 00 30 0F 06 0B
............0...
2B 06 01 04 01 0B 02 04 03 0D 01 05 00 +............

Next message: James Derieg: "POCKET-PC: HOW TO SECURE ACCESS FROM A POCKET PC OUTSIDE TO A SERVER IN THE LAN"

Previous message: Chris Merkel: "RE: Windows Messenger Pop-up spam"
Maybe in reply to: Rino Mardo: "how do i read this IDS log?"
Next in thread: David Gillett: "RE: how do i read this IDS log?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

Re: Measure amount of network usage
... netflow is adequate to this task. ... cheap, but should be other free options out there), it will use SNMP ... you to graph each switchport on the switch (you would need to resolve ... connected to - as i use (up to 200 ports per switch). ...
(comp.dcom.sys.cisco)
Re: Measure amount of network usage
... cheap, but should be other free options out there), it will use SNMP ... you to graph each switchport on the switch (you would need to resolve ... connected to - as i use (up to 200 ports per switch). ... netflow can provide you with more detailed information as you can get with mrtg and i ...
(comp.dcom.sys.cisco)
Re: Unused switch port report for 1/3 months
... If you get it running and have it monitor all of the switch ... ports, not just the ones up at initial running, then you can accumilate data ... MRTG has been around for a while and relies on SNMP for collecting data. ...
(comp.dcom.sys.cisco)
Re: snmp through netscreen 5gt
... I also need to do snmp queries on the netscreen ... We have this setup and working for RDP for both servers on two ... ports 8443 and that is in the log. ...
(comp.security.firewalls)
Re: How to block a port on Hp3000 system
... > these ports on the HP3000 systems of prevent it from responding? ... To disable the SNMP services ... * To join/leave the list, search archives, change list settings, * ...
(comp.sys.hp.mpe)