Re: Anyone else seeing lots of 129 20 this am?

["Joel Esler \(jesler\) via Snort-users" <snort-users () lists snort org>]

As you all know, however, that is a preprocessor alert.  It may be as simple as shutting that preprocessor rule off?

On 8/30/19, 2:17 PM, "Snort-users on behalf of Michael Steele" <snort-users-bounces () lists snort org on behalf of 
michaels () winsnort com> wrote:

    I noticed that too on the last Snort update. Getting a LOT more alerts. I also updated the rules at the same time 
and never went back to the old rules to see if that was where the change came in? 
    
    WINSNORT.com Management Team Member
    --
    ********************************************************
    *     Since 2002 ~~ Visit http://www.winsnort.com
    *      ~~ FREE Windows installation Tutorials ~~
    *              ~~ FREE Support Forums ~~
    * Snort: Open Source Network IDS - http://www.snort.org
    ********************************************************
    
    -----Original Message-----
    From: Snort-users <snort-users-bounces () lists snort org> On Behalf Of James Lay via Snort-users
    Sent: Friday, August 30, 2019 11:26 AM
    To: Joel Esler (jesler) <jesler () cisco com>
    Cc: Snort <snort-users () lists snort org>
    Subject: Re: [Snort-users] Anyone else seeing lots of 129 20 this am?
    
    Something as in snort ;)  Same traffic, a LOT more alerts right after updates.
    
    On 2019-08-30 09:23, Joel Esler (jesler) wrote:
    > When you say "something changed", do you mean "Snort" changed.  Or 
    > "attacker behavior" may be changing?
    > 
    >> On Aug 30, 2019, at 8:13 AM, James Lay via Snort-users 
    >> <snort-users () lists snort org> wrote:
    >> 
    >> Yea something changed....I run ssh on a non-standard port and now I'm 
    >> seeing:
    >> 
    >> [120:18:3] (http_inspect) PROTOCOL-OTHER HTTP server response before 
    >> client request
    >> 
    >> after updating rules this AM:
    >> 
    >> Aug 30 01:10:22 snort[31692]: Decoding Ethernet Aug 30 01:17:53 
    >> snort[31692]: [120:18:3] (http_inspect) PROTOCOL-OTHER HTTP server 
    >> response before client request
    >> 
    >> that http_inspect hit rule is the first time I've seen that in my 
    >> logs....ever 😉
    >> 
    >> James
    >> 
    >> On Fri, 2019-08-30 at 06:05 -0600, James Lay via Snort-users wrote:
    >> 
    >>> Seeing massive amounts of [129:20:1] TCP session without 3-way 
    >>> handshake this morning....seems to be firing off on RST packets.
    >>> 
    >>> James
    >>> 
    >>> <Screenshot from 2019-08-30 06-05-03.png>
    >>> 
    >>> _______________________________________________
    >>> 
    >>> Snort-users mailing list
    >>> 
    >>> Snort-users () lists snort org
    >>> 
    >>> Go to this URL to change user options or unsubscribe:
    >>> 
    >>> https://lists.snort.org/mailman/listinfo/snort-users
    >>> 
    >>> To unsubscribe, send an email to:
    >>> 
    >>> snort-users-leave () lists snort org
    >>> 
    >>> Please visit http://blog.snort.org [1] to stay current on all the 
    >>> latest Snort news!
    >>> 
    >>> Please follow these rules:
    >>> https://snort.org/faq/what-is-the-mailing-list-etiquette
    >> 
    >> _______________________________________________
    >> Snort-users mailing list
    >> Snort-users () lists snort org
    >> Go to this URL to change user options or unsubscribe:
    >> https://lists.snort.org/mailman/listinfo/snort-users
    >> 
    >> To unsubscribe, send an email to:
    >> snort-users-leave () lists snort org
    >> 
    >> Please visit http://blog.snort.org to stay current on all the latest 
    >> Snort news!
    >> 
    >> Please follow these rules:
    >> https://snort.org/faq/what-is-the-mailing-list-etiquette
    > 
    > 
    > 
    > Links:
    > ------
    > [1] http://blog.snort.org/
    _______________________________________________
    Snort-users mailing list
    Snort-users () lists snort org
    Go to this URL to change user options or unsubscribe:
    https://lists.snort.org/mailman/listinfo/snort-users
    
        To unsubscribe, send an email to:
        snort-users-leave () lists snort org
    
    Please visit http://blog.snort.org to stay current on all the latest Snort news!
    
    Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
    
    _______________________________________________
    Snort-users mailing list
    Snort-users () lists snort org
    Go to this URL to change user options or unsubscribe:
    https://lists.snort.org/mailman/listinfo/snort-users
    
        To unsubscribe, send an email to:
        snort-users-leave () lists snort org
    
    Please visit http://blog.snort.org to stay current on all the latest Snort news!
    
    Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Attachment: smime.p7s
Description:

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette