SnortSnarf alert page

Source: 24.209.39.246: overview

SnortSnarf v021111.1

Signature section (91123)

Top 20 source IPs

Top 20 dest IPs

326 such alerts found using input module SnortFileInput, with sources:

/home/rivettmj/snort_alertlog/alert

Earliest: 11:08:33.583102 on 05/02/2003
Latest: 21:52:12.598923 on 05/13/2003

7 different signatures are present for 24.209.39.246 as a source

16 instances of WEB-IIS _mem_bin access
16 instances of WEB-FRONTPAGE /_vti_bin/ access
32 instances of WEB-IIS CodeRed v2 root.exe access
35 instances of WEB-IIS ISAPI .ida attempt
54 instances of WEB-IIS multiple decode attempt
76 instances of WEB-IIS unicode directory traversal attempt
97 instances of WEB-IIS cmd.exe access

There are 1 distinct destination IPs in the alerts of the type on this page.

24.209.39.246 Whois lookup at: ARIN RIPE APNIC Geektools

DNS lookup at: Amenesi TRIUMF Princeton

More lookup links: Dshield Sam Spade

This listing contains 326 alerts. You can:

view the whole listing
view a range of alerts (see table below)

Alert ranges (sorted by time):

alert #'s	first time	last time
1 to 100	11:08:33.583102 on 05/02/2003	11:46:47.078694 on 05/05/2003
101 to 200	11:46:50.365666 on 05/05/2003	18:40:34.689412 on 05/07/2003
201 to 300	18:40:35.534513 on 05/07/2003	20:45:21.951494 on 05/13/2003
301 to 326	20:45:29.809107 on 05/13/2003	21:52:12.598923 on 05/13/2003

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:54 2003