SnortSnarf alert page

Source: 192.168.24.52: overview

SnortSnarf v021111.1

Signature section (16810)

Top 20 source IPs

Top 20 dest IPs

703 such alerts found using input module SnortFileInput, with sources:

/var/log/snort/alert

Earliest: 23:11:49.293178 on 09/03/2009
Latest: 23:35:58.573917 on 09/02/2010

6 different signatures are present for 192.168.24.52 as a source

1 instances of (snort_decoder) WARNING: TCP Data Offset is less than 5!
4 instances of (http_inspect) DOUBLE DECODING ATTACK
12 instances of (http_inspect) OVERSIZE CHUNK ENCODING
32 instances of (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
326 instances of (http_inspect) BARE BYTE UNICODE ENCODING
328 instances of (http_inspect) IIS UNICODE CODEPOINT ENCODING

There are 1 distinct destination IPs in the alerts of the type on this page.

192.168.24.52 Whois lookup at: ARIN RIPE APNIC Geektools

DNS lookup at: Amenesi TRIUMF Princeton

More lookup links: Dshield Sam Spade

This listing contains 703 alerts. You can:

view the whole listing
view a range of alerts (see table below)

Alert ranges (sorted by time):

alert #'s	first time	last time
1 to 100	23:11:49.293178 on 09/03/2009	23:37:41.227442 on 10/29/2009
101 to 200	23:37:59.845636 on 10/29/2009	23:55:55.641344 on 12/05/2009
201 to 300	23:27:57.651044 on 12/06/2009	23:33:59.533559 on 04/22/2010
301 to 400	23:38:56.248070 on 04/22/2010	22:51:52.498336 on 05/17/2010
401 to 500	22:54:13.026883 on 05/17/2010	00:02:20.399801 on 05/22/2010
501 to 600	00:03:37.000765 on 05/22/2010	21:40:55.557426 on 06/17/2010
601 to 700	21:48:21.185130 on 06/17/2010	22:51:47.380709 on 08/30/2010
701 to 703	23:16:30.690640 on 08/31/2010	23:35:58.573917 on 09/02/2010

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Fri Sep 3 22:09:17 2010