SnortSnarf alert page

Destination: 192.168.1.91: #1-100

SnortSnarf v021111.1

Signature section (91123)

Top 20 source IPs

Top 20 dest IPs

Looking using input module SnortFileInput, with sources:

/home/rivettmj/snort_alertlog/alert

Earliest: 01:24:08.398077 on 04/27/2003
Latest: 01:24:19.620458 on 04/27/2003

2 different signatures are present for 192.168.1.91 as a destination

1 instances of SHELLCODE x86 setuid 0
154 instances of SHELLCODE x86 NOOP

There are 2 distinct source IPs in the alerts of the type on this page.

192.168.1.91 Whois lookup at: ARIN RIPE APNIC Geektools

DNS lookup at: Amenesi TRIUMF Princeton

More lookup links: Dshield Sam Spade

Go to: next range, all alerts, overview page

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:08.398077 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64278 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AAD298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455104986 822919594 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:08.482760 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64292 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AB1DE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455104995 822919594 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:08.488656 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64296 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AB3298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455104995 822919594 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:08.529962 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64303 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AB5840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455104999 822919594 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:08.533045 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64306 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5AB6938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105000 822919594 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:08.570469 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64309 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AB7840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105004 822919594 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:08.654125 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64332 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5ABF298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105011 822919594 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.219629 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64340 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AC1840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105069 822919595 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.300591 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64355 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5AC6938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105077 822919595 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.328646 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64357 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AC7298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105080 822919595 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.390078 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64367 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5ACA938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105086 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.396034 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64369 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5ACB298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105086 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.433015 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64375 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5ACD298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105090 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.436186 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64377 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5ACDDE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105090 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.524806 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64391 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5AD2938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105099 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.580375 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64402 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AD6390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105105 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.640366 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64419 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5ADBDE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105110 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.666307 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64420 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5ADC390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105113 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.679838 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64426 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5ADE390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105114 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.802474 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64453 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AE7298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105126 822919596 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.848636 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64465 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AEB298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105131 822919597 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.886923 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64474 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AEE390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105135 822919597 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:09.937443 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64483 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AF1298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105140 822919597 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.081159 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64520 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AFD840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105155 822919597 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.126034 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64527 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5AFFDE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105159 822919597 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.135731 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64533 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B01DE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105160 822919597 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.327369 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64587 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B13DE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105179 822919597 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.558496 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64636 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B24390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105202 822919598 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.666200 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64658 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B2B840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105213 822919598 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.828685 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64700 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B39840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105230 822919598 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.889463 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64719 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B3FDE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105235 822919599 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.936335 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64728 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B42CF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105240 822919599 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:10.982770 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64737 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B45DE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105245 822919599 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:11.870985 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64789 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B56CF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105334 822919601 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:11.983242 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64812 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5B5E938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105345 822919601 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:12.143724 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64845 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B69840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105361 822919601 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:12.158386 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64848 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5B6A938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105363 822919601 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:12.277949 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64877 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B74390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105374 822919601 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:12.285313 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64882 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B75DE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105375 822919601 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:12.389746 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:64900 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B7BDE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105385 822919602 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:12.894807 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65008 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5B9FDE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105436 822919603 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:12.972000 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65022 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5BA4938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105444 822919603 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:12.988155 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65029 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5BA6CF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105446 822919603 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:13.020913 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65039 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5BAA390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105449 822919603 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:13.049597 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65045 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5BAC390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105451 822919603 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:13.102077 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65060 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5BB1298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105456 822919603 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:13.232174 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65095 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5BBCCF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105470 822919603 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:13.520580 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65175 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5BD7840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105499 822919604 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:13.561213 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65186 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5BDB298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105503 822919604 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:13.852190 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65251 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5BF0CF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105531 822919605 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:14.392025 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65344 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C0F840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105586 822919606 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:14.745253 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65431 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5C2C938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105621 822919606 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.085138 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65491 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5C40938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105651 822919607 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.113809 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65496 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C42390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105654 822919607 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.181119 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65504 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C44CF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105662 822919607 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.281056 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65520 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C4A390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105671 822919607 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.285067 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65521 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5C4A938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105672 822919607 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.470212 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:18 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C55840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105691 822919608 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.681054 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:54 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C61840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105715 822919608 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.735609 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:65 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C65298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105718 822919608 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.802018 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:77 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C69298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105724 822919608 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.857127 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:87 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5C6C938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105731 822919608 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.900641 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:93 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5C6E938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105736 822919609 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.946404 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:101 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C71298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105737 822919609 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.978408 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:104 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C72390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105740 822919609 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:15.998354 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:108 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C73840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105743 822919609 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.186614 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:133 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C7BDE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105761 822919609 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.441734 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:179 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C8B298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105790 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.454206 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:181 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C8BDE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105790 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.464988 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:183 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5C8C938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105790 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.470590 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:184 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C8CCF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105791 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.505677 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:190 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C8ECF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105796 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.530274 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:194 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C90390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105797 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.550078 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:198 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C91840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105801 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.664692 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:219 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5C98938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105813 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.700931 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:225 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5C9A938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105814 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.774506 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:238 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5C9ECF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105822 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.814099 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:245 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CA1298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105825 822919610 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.884321 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:256 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CA4CF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105835 822919611 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.898016 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:260 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CA6390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105836 822919611 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:16.933736 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:266 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CA8390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105839 822919611 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:17.141344 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:295 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CB1DE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105857 822919611 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:17.145395 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:296 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CB2390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105857 822919611 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:17.149036 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:297 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5CB2938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105858 822919611 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:17.476554 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:351 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5CC4938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105893 822919612 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:17.482271 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:352 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CC4CF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105893 822919612 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:17.536733 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:361 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CC7DE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105901 822919612 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:17.717696 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:394 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CD2CF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105916 822919612 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:18.053831 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:448 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CE4CF0  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105949 822919613 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:18.290147 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:487 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5CF1DE8  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455105974 822919613 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:18.618139 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:545 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5D05298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106006 822919614 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:18.821611 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:582 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5D11840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106027 822919614 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:18.885670 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:593 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5D15298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106033 822919615 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:18.918209 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:599 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5D17298  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106036 822919615 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:18.940607 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:603 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5D18938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106038 822919615 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:18.998010 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:612 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5D1B840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106043 822919615 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:19.214370 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:644 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5D26390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106064 822919615 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:19.497792 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:690 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5D35840  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106094 822919616 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:19.546070 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:698 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xD5D38390  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106098 822919616 
[Xref => http://www.whitehats.com/info/IDS181]

[**] [1:648:5] SHELLCODE x86 NOOP [**]
[Classification: Executable code was detected] [Priority: 1] 
04/27-01:24:19.620458 207.172.2.141:80 -> 192.168.1.91:9108
TCP TTL:51 TOS:0x0 ID:711 IpLen:20 DgmLen:1004 DF
***A**** Seq: 0xD5D3C938  Ack: 0xF3BF5C17  Win: 0xF447  TcpLen: 32
TCP Options (3) => NOP NOP TS: 455106106 822919616 
[Xref => http://www.whitehats.com/info/IDS181]

Go to: next range, all alerts, overview page

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:09:28 2003

192.168.1.91	Whois lookup at:	ARIN	RIPE	APNIC	Geektools
	DNS lookup at:	Amenesi	TRIUMF	Princeton
	More lookup links:	Dshield	Sam Spade