[7.865][QUESTION][ANSWERED] ipv6 using utils gives false positive

Hello Fiends !

today 1st time i got ips alert

trying many ipv6 utils to check so really dont know when this message came and notice very late

i have added 3653 rule in pf for UDP AND TCP gor gogo (ipv6 client)

2010:02:02-17:25:15 acenn snort[6066]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="MISC UPnP Location overflow attempt" group="450" srcip="81.171.72.13" dstip="192.168.2.150" proto="17" srcport="3653" dstport="1797" sid="1388" class="Misc Attack" priority="2" generator="1" msgid="0"

or it was really .....

Parents

0 SvenW over 15 years ago

Hello utm_kit,

when does this ips event gets triggert?
constantly?|at startup?|sometimes?

the IPS guy, sven
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 SvenW over 15 years ago

Hello utm_kit,

when does this ips event gets triggert?
constantly?|at startup?|sometimes?

the IPS guy, sven
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 utm_kid over 15 years ago in reply to SvenW

Hello sven ,

did u check tcpdump log ?

i think its constantly i check with this (7.866)version also , i dont get ips log but i can see same ip in bandwidth monitor

thanks
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 SvenW over 15 years ago in reply to utm_kid

utk_kit,

yes I checked the pcap file, my ips doesn't detect an alert,
I check this via:

1. copy you pcap into the snort chroot
"cp pcapfile /var/chroot-snort/"

2. run snort against this pcap
"chroot /var/chroot-snort /sbin/snort_inline -A cmg -c /etc/snort/snort.conf --treat-drop-as-alert --process-all-events --pcap-single YOURPCAPFILE"

I got a the end of the report: "ALERTS: 0"
So there is no attack in your pcap.

I think we have to reproduce it to say more, I'll do that this week.

Best Sven
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 utm_kid over 15 years ago in reply to SvenW

hi Sven,

I face this problem only 1-2 time but after that i dont able to see ips alert but there was some traffic from that ip

if u think that is ok u can close the thread

thanks
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel