[Silicon Defense logo]

SnortSnarf alert page

Source: 24.209.191.210

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

28 such alerts found using input module SnortFileInput, with sources:
Earliest: 20:01:35.301224 on 05/16/2003
Latest: 12:51:48.793078 on 05/18/2003

2 different signatures are present for 24.209.191.210 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.209.191.210 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/16-20:01:35.301224 24.209.191.210:3482 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:63540 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x4815669A Ack: 0x7175C5DD Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/16-20:01:35.311764 24.209.191.210:3482 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:63541 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x48156C4E Ack: 0x7175C5DD Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/16-21:09:26.286616 24.209.191.210:1518 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:484 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xBBC1765F Ack: 0x7219AA8A Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/16-21:09:26.298946 24.209.191.210:1518 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:485 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xBBC17C13 Ack: 0x7219AA8A Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/16-21:30:08.769551 24.209.191.210:1680 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:31341 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x28E1C2E2 Ack: 0xC061D977 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/16-21:30:08.776386 24.209.191.210:1680 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:31342 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x28E1C896 Ack: 0xC061D977 Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/17-03:53:50.572135 24.209.191.210:2765 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:29818 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x4809CEFA Ack: 0x6A3E6F50 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/17-03:53:50.580649 24.209.191.210:2765 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:29819 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x4809D4AE Ack: 0x6A3E6F50 Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/17-04:49:26.352275 24.209.191.210:4897 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:26566 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x31A11544 Ack: 0x3D062F82 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/17-04:49:26.360351 24.209.191.210:4897 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:26567 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x31A11AF8 Ack: 0x3D062F82 Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/17-09:32:56.596550 24.209.191.210:3048 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:28845 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x59D3B5B4 Ack: 0x6AF46D2E Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/17-09:32:56.604125 24.209.191.210:3048 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:28846 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x59D3BB68 Ack: 0x6AF46D2E Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/17-09:36:24.984194 24.209.191.210:2230 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:38128 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x65BB9477 Ack: 0x774CEA6D Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/17-09:36:24.993691 24.209.191.210:2230 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:38129 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x65BB9A2B Ack: 0x774CEA6D Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-04:23:34.555143 24.209.191.210:3463 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:49236 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x536060EA Ack: 0x1B69F6EF Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-04:23:34.570216 24.209.191.210:3463 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:49237 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x5360669E Ack: 0x1B69F6EF Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-04:38:05.152220 24.209.191.210:4842 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:59689 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xA8713AF0 Ack: 0x509C3687 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-04:38:05.160191 24.209.191.210:4842 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:59690 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xA87140A4 Ack: 0x509C3687 Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-06:30:04.836825 24.209.191.210:3714 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:27297 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x1DC372E4 Ack: 0xF7EF3161 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-06:30:04.844673 24.209.191.210:3714 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:27298 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x1DC37898 Ack: 0xF7EF3161 Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-06:38:10.459264 24.209.191.210:4936 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:1316 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x4A770026 Ack: 0x16352886 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-06:38:10.467865 24.209.191.210:4936 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:1317 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x4A7705DA Ack: 0x16352886 Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-08:09:38.901127 24.209.191.210:2858 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:41956 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x38A46918 Ack: 0x6F652D01 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-08:09:38.909569 24.209.191.210:2858 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:41957 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x38A46ECC Ack: 0x6F652D01 Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-11:59:42.216232 24.209.191.210:4080 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:33699 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xA1428275 Ack: 0xD4F68F2E Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-11:59:42.223880 24.209.191.210:4080 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:33700 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0xA1428829 Ack: 0xD4F68F2E Win: 0x4470 TcpLen: 20
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-12:51:48.786484 24.209.191.210:1172 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:42012 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x90A08ACC Ack: 0x9A904492 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/18-12:51:48.793078 24.209.191.210:1172 -> 192.168.1.6:80
TCP TTL:116 TOS:0x0 ID:42013 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x90A09080 Ack: 0x9A904492 Win: 0x4470 TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:09:28 2003