snort rules (Was: Attack alert from snort)

To: debian-security@lists.debian.org
Subject: snort rules (Was: Attack alert from snort)
From: "Martin Domig" <md@ims.at>
Date: Thu, 12 Jul 2001 10:33:42 +0200
Message-id: <[🔎] 20010712103341.B3145@linuxpunk.org>
In-reply-to: <[🔎] 00f001c1062d$0e8cfba0$0600a8c0@logisys.ht>
References: <[🔎] 00f001c1062d$0e8cfba0$0600a8c0@logisys.ht>

Hello

As I am using snort I keep getting many warnings in my logfiles which I
don't know what they mean. For example the following entry:

Jul 11 01:17:46 keeper snort[6079]: IDS266 - CAN-1999-0261 - SMTP Chameleon
Overflow: xxx.xxx.xxx.xxx:44772 -> yyy.yyy.yyy.yyy:25

This tells me that someone is doing funny stuff to my mailserver (I keep
getting those all the time), but I don't know what is causing this entry
and how "dangerous" this "attack" is. Is there any resource where I can
search for snort warnings (those IDSxxx codes) and look up more information
about a single snort rule?

Regards

Martin Domig

Attachment: pgpW80hnqfBOe.pgp
Description: PGP signature

Reply to:

Follow-Ups:
- Re: snort rules (Was: Attack alert from snort)
  - From: Jigal Weinberg <jigal@cistron-office.nl>
- Re: snort rules (Was: Attack alert from snort)
  - From: Bart-Jan Vrielink <bartjan@vrielink.net>

References:
- Attack alert from snort
  - From: "Philippe Clérié" <philippe@gcal.net>

Prev by Date: Re: was I cracked? (rpc.statd, new version)
Next by Date: Re: was I cracked? (rpc.statd, new version)
Previous by thread: Re: Snort
Next by thread: Re: snort rules (Was: Attack alert from snort)
Index(es):
- Date
- Thread