[Silicon Defense logo]

SnortSnarf alert page

Source: 24.214.98.64

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

6 such alerts found using input module SnortFileInput, with sources:
Earliest: 18:35:24.638803 on 05/03/2003
Latest: 18:36:16.726231 on 05/03/2003

4 different signatures are present for 24.214.98.64 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.214.98.64 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/03-18:35:24.638803 24.214.98.64:2756 -> 192.168.1.6:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:112
***AP*** Seq: 0x554A5F28 Ack: 0xBDDC4E4F Win: 0x0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/03-18:35:25.061610 24.214.98.64:2788 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:44698 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x5564CF1A Ack: 0x5EF6F82B Win: 0x16D0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/03-18:35:34.899918 24.214.98.64:3312 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:46241 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x5708BC45 Ack: 0x5F1FD3B7 Win: 0x16D0 TcpLen: 20
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/03-18:36:14.775394 24.214.98.64:1613 -> 192.168.1.6:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:137
***AP*** Seq: 0x62BF0840 Ack: 0x0 Win: 0x0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/03-18:36:15.514936 24.214.98.64:1642 -> 192.168.1.6:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:138
***AP*** Seq: 0x62E4E29D Ack: 0x0 Win: 0x0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/03-18:36:16.726231 24.214.98.64:1668 -> 192.168.1.6:80
TCP TTL:240 TOS:0x10 ID:0 IpLen:20 DgmLen:136
***AP*** Seq: 0x622FE8B7 Ack: 0x0 Win: 0x0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:52 2003