[Silicon Defense logo]

SnortSnarf alert page

Destination: 192.168.1.100

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

38 such alerts found using input module SnortFileInput, with sources:
Earliest: 20:45:21.886143 on 04/26/2003
Latest: 16:27:25.543066 on 06/16/2003

7 different signatures are present for 192.168.1.100 as a destination

There are 8 distinct source IPs in the alerts of the type on this page.

192.168.1.100 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade
See also 192.168.1.100 as an alert source [4 alerts]

[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
04/26-20:45:21.886143 66.84.25.254:110 -> 192.168.1.100:3248
TCP TTL:45 TOS:0x0 ID:43797 IpLen:20 DgmLen:1420 DF
***AP*** Seq: 0xB156752B Ack: 0xF4003291 Win: 0x7BFC TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
04/28-17:38:07.708643 66.54.32.136:80 -> 192.168.1.100:1268
TCP TTL:238 TOS:0x0 ID:5853 IpLen:20 DgmLen:1420 DF
***A**** Seq: 0xE140A0D5 Ack: 0xD4E05764 Win: 0x86C4 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
04/29-16:15:30.951942 206.24.192.157:80 -> 192.168.1.100:2493
TCP TTL:50 TOS:0x0 ID:68 IpLen:20 DgmLen:1500
***A**** Seq: 0x1A43CA8 Ack: 0x2BA9564F Win: 0x2180 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
04/29-16:15:31.525979 206.24.192.157:80 -> 192.168.1.100:2493
TCP TTL:50 TOS:0x0 ID:71 IpLen:20 DgmLen:1500
***A**** Seq: 0x1A44886 Ack: 0x2BA95793 Win: 0x2180 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
04/29-16:15:32.654665 206.24.192.157:80 -> 192.168.1.100:2493
TCP TTL:50 TOS:0x0 ID:127 IpLen:20 DgmLen:1500
***A**** Seq: 0x1A587E6 Ack: 0x2BA95793 Win: 0x2180 TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/03-04:05:28.819870 66.84.25.254:110 -> 192.168.1.100:4377
TCP TTL:45 TOS:0x0 ID:42360 IpLen:20 DgmLen:1026 DF
***AP*** Seq: 0x442E474E Ack: 0x4467455F Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/12-19:39:29.711668 66.84.25.254:110 -> 192.168.1.100:3111
TCP TTL:45 TOS:0x0 ID:6543 IpLen:20 DgmLen:1022 DF
***AP*** Seq: 0x31BE265E Ack: 0x6FFE5B04 Win: 0x7BFC TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
05/14-06:40:36.583832 216.198.200.9:80 -> 192.168.1.100:1648
TCP TTL:50 TOS:0x0 ID:3911 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x273BED75 Ack: 0x2A7C42AE Win: 0x1920 TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/19-16:16:45.855657 66.84.25.254:110 -> 192.168.1.100:1711
TCP TTL:45 TOS:0x0 ID:51673 IpLen:20 DgmLen:1420 DF
***AP*** Seq: 0x389FC458 Ack: 0xF4D1FF4 Win: 0x7BFC TcpLen: 20
[**] [1:721:3] Virus - Possible pif Worm [**]
[Classification: Misc activity] [Priority: 3]
05/20-20:52:47.196496 66.84.25.254:110 -> 192.168.1.100:3554
TCP TTL:45 TOS:0x0 ID:34727 IpLen:20 DgmLen:994 DF
***AP*** Seq: 0x9014F0FA Ack: 0x92AD2015 Win: 0x7BFC TcpLen: 20
[**] [1:721:3] Virus - Possible pif Worm [**]
[Classification: Misc activity] [Priority: 3]
05/20-21:34:40.926342 66.84.25.254:110 -> 192.168.1.100:3658
TCP TTL:45 TOS:0x0 ID:62884 IpLen:20 DgmLen:1052 DF
***AP*** Seq: 0x2B8A6176 Ack: 0xB53216D0 Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/27-16:19:57.499743 66.84.25.254:110 -> 192.168.1.100:2621
TCP TTL:46 TOS:0x0 ID:9837 IpLen:20 DgmLen:1030 DF
***AP*** Seq: 0x28C1C0D3 Ack: 0x12B28400 Win: 0x7BFC TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
05/27-16:19:57.582748 66.84.25.254:110 -> 192.168.1.100:2621
TCP TTL:46 TOS:0x0 ID:9865 IpLen:20 DgmLen:1420 DF
***AP*** Seq: 0x28C1CF79 Ack: 0x12B28400 Win: 0x7BFC TcpLen: 20
[**] [1:1394:3] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
05/30-00:35:10.675583 65.24.2.12:119 -> 192.168.1.100:1235
TCP TTL:247 TOS:0x0 ID:23166 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x3C54B26F Ack: 0xF1EE1851 Win: 0x2238 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
05/31-20:23:41.715313 209.208.134.37:80 -> 192.168.1.100:3076
TCP TTL:112 TOS:0x0 ID:31177 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x2265357F Ack: 0x5C5CB084 Win: 0x2091 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
05/31-20:23:42.324180 209.208.134.37:80 -> 192.168.1.100:3076
TCP TTL:112 TOS:0x0 ID:48585 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x2265B2F7 Ack: 0x5C5CB084 Win: 0x2091 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
05/31-20:23:42.764732 209.208.134.37:80 -> 192.168.1.100:3076
TCP TTL:112 TOS:0x0 ID:458 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x22660883 Ack: 0x5C5CB084 Win: 0x2091 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
05/31-20:23:43.259226 209.208.134.37:80 -> 192.168.1.100:3076
TCP TTL:112 TOS:0x0 ID:16842 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x226674DF Ack: 0x5C5CB084 Win: 0x2091 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
05/31-20:23:43.871064 209.208.134.37:80 -> 192.168.1.100:3076
TCP TTL:112 TOS:0x0 ID:36810 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x2266F80B Ack: 0x5C5CB084 Win: 0x2091 TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
06/01-14:47:43.493564 66.84.25.254:110 -> 192.168.1.100:3598
TCP TTL:46 TOS:0x0 ID:16240 IpLen:20 DgmLen:1420 DF
***AP*** Seq: 0xBFC3910F Ack: 0xE3A54057 Win: 0x7BFC TcpLen: 20
[**] [1:726:3] Virus - Possible MyRomeo Worm [**]
[Classification: Misc activity] [Priority: 3]
06/01-14:47:43.785193 66.84.25.254:110 -> 192.168.1.100:3598
TCP TTL:46 TOS:0x0 ID:16264 IpLen:20 DgmLen:993 DF
***AP*** Seq: 0xBFC3AFCF Ack: 0xE3A54067 Win: 0x7BFC TcpLen: 20
[**] [1:726:3] Virus - Possible MyRomeo Worm [**]
[Classification: Misc activity] [Priority: 3]
06/01-14:47:43.794997 66.84.25.254:110 -> 192.168.1.100:3598
TCP TTL:46 TOS:0x0 ID:16270 IpLen:20 DgmLen:835 DF
***AP*** Seq: 0xBFC3C593 Ack: 0xE3A54067 Win: 0x7BFC TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/01-14:48:07.376396 66.54.32.136:80 -> 192.168.1.100:3652
TCP TTL:239 TOS:0x0 ID:56369 IpLen:20 DgmLen:1420 DF
***A**** Seq: 0x39399ED Ack: 0xE415E74D Win: 0x86C4 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/05-17:06:43.871724 209.208.134.37:80 -> 192.168.1.100:4602
TCP TTL:112 TOS:0x0 ID:26754 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x3A3DE8A4 Ack: 0xC1417013 Win: 0x20A5 TcpLen: 20
[**] [1:1841:2] WEB-CLIENT javascript URL host spoofing attempt [**]
[Classification: Attempted User Privilege Gain] [Priority: 1]
06/07-12:56:30.995172 209.202.195.198:80 -> 192.168.1.100:4226
TCP TTL:112 TOS:0x0 ID:1373 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x4FA2F0E5 Ack: 0xF01619EA Win: 0xFA2C TcpLen: 20
[Xref => http://www.securityfocus.com/bid/5293]
[**] [1:726:3] Virus - Possible MyRomeo Worm [**]
[Classification: Misc activity] [Priority: 3]
06/08-15:34:36.254412 66.84.25.254:110 -> 192.168.1.100:1666
TCP TTL:46 TOS:0x0 ID:23404 IpLen:20 DgmLen:1008 DF
***AP*** Seq: 0x273C4EEF Ack: 0x7EFFC4BD Win: 0x7BFC TcpLen: 20
[**] [1:726:3] Virus - Possible MyRomeo Worm [**]
[Classification: Misc activity] [Priority: 3]
06/08-15:34:36.257360 66.84.25.254:110 -> 192.168.1.100:1666
TCP TTL:46 TOS:0x0 ID:23407 IpLen:20 DgmLen:1029 DF
***AP*** Seq: 0x273C5A59 Ack: 0x7EFFC4BD Win: 0x7BFC TcpLen: 20
[**] [1:649:5] SHELLCODE x86 setgid 0 [**]
[Classification: A system call was detected] [Priority: 2]
06/11-00:15:28.351232 216.168.224.69:80 -> 192.168.1.100:3961
TCP TTL:237 TOS:0x0 ID:23428 IpLen:20 DgmLen:1500
***A**** Seq: 0xA5ABB81E Ack: 0x5165D1FE Win: 0xFAF0 TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS284]
[**] [1:649:5] SHELLCODE x86 setgid 0 [**]
[Classification: A system call was detected] [Priority: 2]
06/11-00:15:28.447014 216.168.224.69:80 -> 192.168.1.100:3960
TCP TTL:237 TOS:0x0 ID:23442 IpLen:20 DgmLen:1500
***A**** Seq: 0xEE5E8BC6 Ack: 0x5164BFAE Win: 0xFAF0 TcpLen: 20
[Xref => http://www.whitehats.com/info/IDS284]
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/13-00:25:03.387588 65.24.2.12:119 -> 192.168.1.100:1546
TCP TTL:247 TOS:0x0 ID:4950 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE550337A Ack: 0x536316E2 Win: 0x2238 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/13-00:25:03.388935 65.24.2.12:119 -> 192.168.1.100:1546
TCP TTL:247 TOS:0x0 ID:4951 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE550392E Ack: 0x536316E2 Win: 0x2238 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/13-00:25:03.390309 65.24.2.12:119 -> 192.168.1.100:1546
TCP TTL:247 TOS:0x0 ID:4952 IpLen:20 DgmLen:1500 DF
***AP*** Seq: 0xE5503EE2 Ack: 0x536316E2 Win: 0x2238 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/13-00:25:03.404352 65.24.2.12:119 -> 192.168.1.100:1546
TCP TTL:247 TOS:0x0 ID:4961 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE5506CD7 Ack: 0x536316E2 Win: 0x2238 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/13-00:25:03.405705 65.24.2.12:119 -> 192.168.1.100:1546
TCP TTL:247 TOS:0x0 ID:4962 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE550728B Ack: 0x536316E2 Win: 0x2238 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/13-00:25:03.407027 65.24.2.12:119 -> 192.168.1.100:1546
TCP TTL:247 TOS:0x0 ID:4963 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE550783F Ack: 0x536316E2 Win: 0x2238 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/13-00:25:03.408375 65.24.2.12:119 -> 192.168.1.100:1546
TCP TTL:247 TOS:0x0 ID:4964 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xE5507DF3 Ack: 0x536316E2 Win: 0x2238 TcpLen: 20
[**] [1:1390:3] SHELLCODE x86 inc ebx NOOP [**]
[Classification: Executable code was detected] [Priority: 1]
06/13-00:25:03.409689 65.24.2.12:119 -> 192.168.1.100:1546
TCP TTL:247 TOS:0x0 ID:4965 IpLen:20 DgmLen:1500 DF
***AP*** Seq: 0xE55083A7 Ack: 0x536316E2 Win: 0x2238 TcpLen: 20
[**] [1:729:3] Virus - Possible scr Worm [**]
[Classification: Misc activity] [Priority: 3]
06/16-16:27:25.543066 66.84.25.254:110 -> 192.168.1.100:4862
TCP TTL:46 TOS:0x0 ID:47477 IpLen:20 DgmLen:1001 DF
***AP*** Seq: 0x13B61A5D Ack: 0xB7E6A5C4 Win: 0x7BFC TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:09:54 2003