SnortSnarf alert page

Source: 192.168.24.52: overview

SnortSnarf v021111.1

Signature section (16810)

Top 20 source IPs

Top 20 dest IPs

703 such alerts found using input module SnortFileInput, with sources:

/var/log/snort/alert

Earliest: 23:13:20.797295 on 04/17/2009
Latest: 23:20:15.868307 on 02/11/2010

6 different signatures are present for 192.168.24.52 as a source

1 instances of (snort_decoder) WARNING: TCP Data Offset is less than 5!
4 instances of (http_inspect) DOUBLE DECODING ATTACK
12 instances of (http_inspect) OVERSIZE CHUNK ENCODING
32 instances of (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
326 instances of (http_inspect) BARE BYTE UNICODE ENCODING
328 instances of (http_inspect) IIS UNICODE CODEPOINT ENCODING

There are 1 distinct destination IPs in the alerts of the type on this page.

192.168.24.52 Whois lookup at: ARIN RIPE APNIC Geektools

DNS lookup at: Amenesi TRIUMF Princeton

More lookup links: Dshield Sam Spade

This listing contains 703 alerts. You can:

view the whole listing
view a range of alerts (see table below)

Alert ranges (sorted by time):

alert #'s	first time	last time
1 to 100	23:13:20.797295 on 04/17/2009	22:44:21.587506 on 05/17/2009
101 to 200	22:45:28.215921 on 05/17/2009	23:52:49.814578 on 05/21/2009
201 to 300	23:54:02.238817 on 05/21/2009	22:36:54.266723 on 06/13/2009
301 to 400	23:18:54.999976 on 06/13/2009	22:25:34.264730 on 08/28/2009
401 to 500	22:13:09.075345 on 08/29/2009	23:49:05.502397 on 10/18/2009
501 to 600	23:50:02.941423 on 10/18/2009	22:37:05.130979 on 12/01/2009
601 to 700	22:57:08.026916 on 12/01/2009	23:01:34.351186 on 02/11/2010
701 to 703	23:03:32.178258 on 02/11/2010	23:20:15.868307 on 02/11/2010

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Mar 9 04:57:27 2010