Snort mailing list archives
Re: HTTP Protocol Analysis
From: Sonika Malhotra <sonikam () magnum barc ernet in>
Date: Fri, 14 May 2004 17:22:35 +0530
Hello Christo,we suspect the proxy server more than the user PC in this case, since we are facing this problem from multiple user PC's and
as soon as we disable the proxy-caching, the redirection doesn't happen.and I have checked the proxy server, no extra processes are running on the server.
The cached file in the proxy is poisoned and so all subsequent requests get redirected. How to find how this cache-page is altered.? whether the "persistent-connection" is the culprit or is it something related with virtual-hosts.
Regards Sonika Christo Louw wrote:
Hi Normally www.coolsavings.com is activated by a memory resident program that redirects your browser's output. If you are on a newtork, I suggest that you open on each pc the task manager, and look for a program called save.exe, or any other procces that looks unformiliar to your system setup. That machine will send the redirection page to your proxy and therefor updates it continouisly.----- Original Message ----- From: "Sonika Malhotra" <sonikam () magnum barc ernet in>To: "snort-users" <snort-users () lists sourceforge net> Sent: Friday, May 14, 2004 8:33 AM Subject: [Snort-users] HTTP Protocol AnalysisHello List, I faced a recurrent problem in my network that any request to www.google.com , www.rediff.com .. etc was getting redirected to www.coolsavings.com. So the http traffic dump was taken using Snort. ( logger mode of Snort) The following was found in the HTTP session dump and it can be observed that the reply packet had extra appended tags as follows ... rediff Page contents.... <HTML> <META HTTP-EQUIV=Refresh Content="0; URL=http://www.coolsavings.com";> </HTML> Now this page is cached at our proxy and so all the requests are redirected to new url. when we disable the caching at proxy the problem is taken care of, but the mechanism of doing this is still not known. I shall be grateful it anybody can explain this process. Regards Sonika ------------------------------------------------------- This SF.Net email is sponsored by: SourceForge.net Broadband Sign-up now for SourceForge Broadband and get the fastest 6.0/768 connection for only $19.95/mo for the first 3 months! http://ads.osdn.com/?ad_id=2562&alloc_id=6184&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- This SF.Net email is sponsored by: SourceForge.net Broadband Sign-up now for SourceForge Broadband and get the fastest 6.0/768 connection for only $19.95/mo for the first 3 months! http://ads.osdn.com/?ad_id=2562&alloc_id=6184&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- HTTP Protocol Analysis Sonika Malhotra (May 13)
- Message not available
- Re: HTTP Protocol Analysis Sonika Malhotra (May 14)
- Message not available
- Re: HTTP Protocol Analysis Jason (May 14)
- <Possible follow-ups>
- Re: HTTP Protocol Analysis Sonika Malhotra (May 14)
- Re: HTTP Protocol Analysis Ms.Sonika Malhotra (May 17)
- Re: HTTP Protocol Analysis Keith W. McCammon (May 17)