[Silicon Defense logo]

SnortSnarf alert page

Source: 216.39.48.104

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

10 such alerts found using input module SnortFileInput, with sources:
Earliest: 19:55:43.903728 on 04/17/2003
Latest: 12:56:27.082274 on 04/24/2003

1 different signatures are present for 216.39.48.104 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

216.39.48.104 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/17-19:55:43.903728 216.39.48.104:37763 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:59912 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0x5BD5D06C Ack: 0x8DAFF977 Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 329333370 438048754
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/17-23:53:20.020843 216.39.48.104:37349 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:25904 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0xDCCA9CCD Ack: 0xFC720EC Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 330758642 445350301
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/18-18:24:17.920000 216.39.48.104:57461 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:19834 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0x407FE494 Ack: 0x73DB2904 Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 337422843 479490518
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/22-21:51:47.096051 216.39.48.104:36007 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:44572 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0x4BCBAC40 Ack: 0x8933D3BD Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 373228082 662918165
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/23-07:10:55.423146 216.39.48.104:47221 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:55828 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0x8B4EF5C5 Ack: 0xC86BCF87 Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 376582115 680100636
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/23-14:26:57.688393 216.39.48.104:45917 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:18304 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0xF9785E77 Ack: 0x3786FB2D Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 379197717 693500179
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/23-20:23:19.774670 216.39.48.104:54404 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:22886 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0x3C44EE0E Ack: 0x7A041B44 Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 381335417 704451440
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/23-21:48:56.792523 216.39.48.104:43250 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:51906 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0x7F814758 Ack: 0xBCFD9DDC Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 381848996 707082483
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/24-05:43:04.558668 216.39.48.104:52545 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:47546 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0x7C944AE3 Ack: 0xBC4B4482 Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 384693095 721652605
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
[**] [1:1852:3] WEB-MISC robots.txt access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/24-12:56:27.082274 216.39.48.104:37926 -> 192.168.1.6:80
TCP TTL:37 TOS:0x0 ID:48054 IpLen:20 DgmLen:211 DF
***AP*** Seq: 0xE152259D Ack: 0x20CF648F Win: 0x16D0 TcpLen: 32
TCP Options (3) => NOP NOP TS: 387292726 734970332
[Xref => http://cgi.nessus.org/plugins/dump.php3?id=10302]
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:09:28 2003