SnortSnarf alert page

Source: 192.168.24.52: overview

SnortSnarf v021111.1

Signature section (16810)

Top 20 source IPs

Top 20 dest IPs

703 such alerts found using input module SnortFileInput, with sources:

/var/log/snort/alert

Earliest: 21:53:34.354799 on 09/14/2009
Latest: 23:39:55.534902 on 09/13/2010

6 different signatures are present for 192.168.24.52 as a source

1 instances of (snort_decoder) WARNING: TCP Data Offset is less than 5!
4 instances of (http_inspect) DOUBLE DECODING ATTACK
12 instances of (http_inspect) OVERSIZE CHUNK ENCODING
32 instances of (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
326 instances of (http_inspect) BARE BYTE UNICODE ENCODING
328 instances of (http_inspect) IIS UNICODE CODEPOINT ENCODING

There are 1 distinct destination IPs in the alerts of the type on this page.

192.168.24.52 Whois lookup at: ARIN RIPE APNIC Geektools

DNS lookup at: Amenesi TRIUMF Princeton

More lookup links: Dshield Sam Spade

This listing contains 703 alerts. You can:

view the whole listing
view a range of alerts (see table below)

Alert ranges (sorted by time):

alert #'s	first time	last time
1 to 100	21:53:34.354799 on 09/14/2009	22:58:34.516220 on 10/31/2009
101 to 200	23:01:31.602102 on 10/31/2009	22:30:55.234151 on 12/10/2009
201 to 300	22:30:59.369465 on 12/10/2009	23:49:26.481519 on 05/03/2010
301 to 400	22:58:44.359638 on 05/04/2010	21:48:27.267815 on 05/19/2010
401 to 500	21:49:18.543452 on 05/19/2010	23:30:04.853646 on 05/25/2010
501 to 600	23:33:20.847478 on 05/26/2010	23:05:15.156668 on 06/24/2010
601 to 700	10:03:35.775558 on 06/25/2010	22:15:27.126858 on 09/10/2010
701 to 703	22:15:27.127262 on 09/10/2010	23:39:55.534902 on 09/13/2010

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Sep 14 05:05:30 2010