Astaro User Bulletin Board
Go Back   Astaro User Bulletin Board > Astaro Gateway Products > Network Security: Firewall, NAT, QoS, IPS and more
Reload this Page Strange IPS detections
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Welcome to the Astaro User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 06-28-2009, 09:22 PM
Super Moderator
  
Join Date: Feb 2009
Location: In a galaxy far far away
Posts: 857
Default Strange IPS detections
Hi All

I've just noticed the IPS alerts below and I would like your help because I've never seen them before

Code:
Live Log: Intrusion Prevention System	
Filter:	
	Autoscroll
2009:06:28-21:08:56 stuffman snort[21223]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="218.213.238.230" dstip="86.164.253.43" proto="6" srcport="80" dstport="47537" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:09:25 stuffman snort[21225]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="Bad segment, adjusted size <= 0" group="0" srcip="86.164.253.43" dstip="85.25.149.192" proto="6" srcport="55472" dstport="80" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:14:47 stuffman snort[21225]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="Bad segment, adjusted size <= 0" group="0" srcip="86.164.253.43" dstip="216.163.188.45" proto="6" srcport="36469" dstport="80" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:16:49 stuffman snort[21223]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="68.142.87.104" dstip="86.164.253.43" proto="6" srcport="80" dstport="50359" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:16:49 stuffman snort[21223]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="68.142.87.104" dstip="86.164.253.43" proto="6" srcport="80" dstport="50359" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:17:45 stuffman snort[21223]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="Bad segment, adjusted size <= 0" group="0" srcip="86.164.253.43" dstip="208.78.69.70" proto="6" srcport="60634" dstport="80" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:17:47 stuffman snort[21225]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="Bad segment, adjusted size <= 0" group="0" srcip="86.164.253.43" dstip="85.25.149.192" proto="6" srcport="44972" dstport="80" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:19:01 stuffman snort[21225]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="218.213.238.230" dstip="86.164.253.43" proto="6" srcport="80" dstport="40774" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:19:01 stuffman snort[21225]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="218.213.238.230" dstip="86.164.253.43" proto="6" srcport="80" dstport="40774" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:19:58 stuffman snort[21223]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="Bad segment, adjusted size <= 0" group="0" srcip="86.164.253.43" dstip="85.25.149.192" proto="6" srcport="57966" dstport="80" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:24:56 stuffman snort[11648]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="Bad segment, adjusted size <= 0" group="0" srcip="86.164.253.43" dstip="207.58.136.89" proto="6" srcport="38881" dstport="80" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:54 stuffman snort[11662]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47119" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:54 stuffman snort[11662]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47119" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11648]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47121" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11648]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47121" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11648]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47122" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11648]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47122" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11662]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47126" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11662]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47127" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11662]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47128" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11662]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47126" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11662]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47127" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:56 stuffman snort[11662]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="85.25.149.192" dstip="86.164.253.43" proto="6" srcport="80" dstport="47128" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:59 stuffman snort[11648]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="86.164.253.43" dstip="85.25.149.192" proto="6" srcport="47116" dstport="80" sid="0" class="" priority="3" generator="129" msgid="1"
2009:06:28-21:26:59 stuffman snort[11648]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="TCP Timestamp is outside of PAWS window" group="0" srcip="86.164.253.43" dstip="85.25.149.192" proto="6" srcport="47116" dstport="80" sid="0" class="" priority="3" generator="129" msgid="1
The messages started to appear later today,after I've installed hmailserver on a box. The application is not configured yet.
__________________

Running Astaro ASG virtual appliance | Home power user 100 IP license
Intel Dual Core 2.4GHz (800MHz) | 4GB (2 x 2GB) PC2-6400 800Mhz 5-5-5-18 | WD 160GB |3 x Intel Pro/1000
Last edited by wingman; 06-28-2009 at 09:28 PM.
Reply With Quote
  #2 (permalink)  
Old 06-29-2009, 11:45 AM
Junior Member
  
Join Date: May 2008
Posts: 13
Default
that comes due the IPS Stream5 preprocessor function "detect_anomalies",
we will change the behaviour of this in one of our next beta system up2dates.

SvenW
ASTARO AG
Reply With Quote
  #3 (permalink)  
Old 06-29-2009, 07:20 PM
Super Moderator
  
Join Date: Feb 2009
Location: In a galaxy far far away
Posts: 857
Default
thanks SvenW
__________________

Running Astaro ASG virtual appliance | Home power user 100 IP license
Intel Dual Core 2.4GHz (800MHz) | 4GB (2 x 2GB) PC2-6400 800Mhz 5-5-5-18 | WD 160GB |3 x Intel Pro/1000
Reply With Quote
Reply

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 02:02 PM.

 
Contact Us - Astaro User Bulletin Board - Archive - Top

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.


These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases. issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.