SnortSnarf alert page

Source: 24.209.105.156: overview

SnortSnarf v021111.1

Signature section (91123)

Top 20 source IPs

Top 20 dest IPs

306 such alerts found using input module SnortFileInput, with sources:

/home/rivettmj/snort_alertlog/alert

Earliest: 01:20:18.341110 on 05/01/2003
Latest: 13:16:46.098697 on 05/05/2003

7 different signatures are present for 24.209.105.156 as a source

13 instances of WEB-IIS ISAPI .ida attempt
18 instances of WEB-IIS _mem_bin access
18 instances of WEB-FRONTPAGE /_vti_bin/ access
36 instances of WEB-IIS CodeRed v2 root.exe access
52 instances of WEB-IIS multiple decode attempt
82 instances of WEB-IIS cmd.exe access
87 instances of WEB-IIS unicode directory traversal attempt

There are 1 distinct destination IPs in the alerts of the type on this page.

24.209.105.156 Whois lookup at: ARIN RIPE APNIC Geektools

DNS lookup at: Amenesi TRIUMF Princeton

More lookup links: Dshield Sam Spade

This listing contains 306 alerts. You can:

view the whole listing
view a range of alerts (see table below)

Alert ranges (sorted by time):

alert #'s	first time	last time
1 to 100	01:20:18.341110 on 05/01/2003	11:04:01.310561 on 05/04/2003
101 to 200	11:04:01.643211 on 05/04/2003	03:44:57.698400 on 05/05/2003
201 to 300	03:45:01.306152 on 05/05/2003	13:16:20.425840 on 05/05/2003
301 to 306	13:16:33.319095 on 05/05/2003	13:16:46.098697 on 05/05/2003

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:09:28 2003