[7.901][NOTABUG][CLOSED] using Remote Logfile Archives use ips alert

Hello Friends !

i was facing this problem with 7.900 also but wait for new version to come and some other things

i have configure logging>>setting>>Remote Logfile Archives  on ubuntu server 9.10 previosly i did configure same thing on suse sles 10 but now i am using ubuntu server
using ftp server for remote log archives

2010:04:09-12:26:30 acenn snort[8234]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="RPC portmap proxy attempt UDP" group="440" srcip="192.168.3.125" dstip="192.168.2.255" proto="17" srcport="55344" dstport="111" sid="1923" class="Decode of an RPC Query" priority="2" generator="1" msgid="0"

my ubuntu server is 192.168.3.125 in/on DMZ but dont know how desip is 192.168.2.225

my asg server is 192.168.2.100

ifconfig
eth0      Link encap:Ethernet  HWaddr 00:0C:29:9A:46:66
          inet addr:192.168.2.100  Bcast:192.168.2.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:98131 errors:0 dropped:0 overruns:0 frame:0
          TX packets:93642 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:48514766 (46.2 Mb)  TX bytes:88172071 (84.0 Mb)

i am using esxi 4 with update1

thanks

Parents

0 kbr over 15 years ago

i guess this might either be related to some tcpwrapper configuration (take a look at [FONT="Courier New"]/etc/hosts.{allow|deny}[/FONT] on your Ubuntu server), or maybe the vsftpd '[FONT="Courier New"]session_support[/FONT]' option, together with NIS/YP might send RPC requests to look up user information on the connecting host. If '[FONT="Courier New"]session_support[/FONT]' is enabled, take a look at the files under [FONT="Courier New"]/etc/pam.d[/FONT], maybe there's something related to vsftpd.

Anyway, as far as i understand you, the logging functionality of the ASG isn't hindered by this. Is this really an ASG bug?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 utm_kid over 15 years ago in reply to kbr

Thanks
this problem seems to be fix becase of
u2d-ips-7-170 Thu Apr 15 09:47:09 2010, OR

u2d-geoipxt-7-3 Wed Apr 14 15:12:09 2010

thx
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 utm_kid over 15 years ago in reply to utm_kid

Thanks
this problem seems to be fix becase of
u2d-ips-7-170                                 Thu Apr 15 09:47:09 2010, OR

u2d-geoipxt-7-3                               Wed Apr 14 15:12:09 2010

thx

at the same time i did not check the log on remote server there is no ips alart as well as no copy of backup

if want ,u have login dtls for  my system please check

thanks
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 utm_kid over 15 years ago in reply to utm_kid

Hello !

can u please check this tcpdump and tell me with this i should able to get log on my server ?

i am not able to get log on remote server

reading from file ftp.pcap, link-type LINUX_SLL (Linux cooked)
14:40:10.633125 IP 192.168.3.100.35040 > 192.168.3.125.21: S 2364572529:2364572529(0) win 5840
14:40:10.633417 IP 192.168.3.125.21 > 192.168.3.100.35040: S 1098201604:1098201604(0) ack 2364572530 win 5792
14:40:10.633649 IP 192.168.3.100.35040 > 192.168.3.125.21: . ack 1 win 46
14:40:10.638336 IP 192.168.3.125.21 > 192.168.3.100.35040: P 1:21(20) ack 1 win 46
14:40:10.638647 IP 192.168.3.100.35040 > 192.168.3.125.21: . ack 21 win 46
14:40:10.638767 IP 192.168.3.100.35040 > 192.168.3.125.21: P 1:16(15) ack 21 win 46
14:40:10.638978 IP 192.168.3.125.21 > 192.168.3.100.35040: . ack 16 win 46
14:40:10.638987 IP 192.168.3.125.21 > 192.168.3.100.35040: P 21:55(34) ack 16 win 46
14:40:10.639194 IP 192.168.3.100.35040 > 192.168.3.125.21: P 16:23(7) ack 55 win 46
14:40:10.678120 IP 192.168.3.125.21 > 192.168.3.100.35040: . ack 23 win 46
14:40:13.336251 IP 192.168.3.125.21 > 192.168.3.100.35040: P 55:77(22) ack 23 win 46
14:40:13.336587 IP 192.168.3.100.35040 > 192.168.3.125.21: P 23:29(6) ack 77 win 46
14:40:13.336715 IP 192.168.3.125.21 > 192.168.3.100.35040: . ack 29 win 46
14:40:13.338041 IP 192.168.3.125.21 > 192.168.3.100.35040: P 77:91(14) ack 29 win 46
14:40:13.338056 IP 192.168.3.125.21 > 192.168.3.100.35040: F 91:91(0) ack 29 win 46
14:40:13.338850 IP 192.168.3.100.35040 > 192.168.3.125.21: F 29:29(0) ack 92 win 46
14:40:13.339621 IP 192.168.3.125.21 > 192.168.3.100.35040: . ack 30 win 46

asg and ubuntu are guest on esxi it was working but after some ips update it seems not working before it was giving ips alert

thanks
if u want login dtls for both system pls let me know
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 utm_kid over 15 years ago in reply to utm_kid

Hello !

can u please check this tcpdump and tell me with this i should able to get log on my server ?

i am not able to get log on remote server

reading from file ftp.pcap, link-type LINUX_SLL (Linux cooked)
14:40:10.633125 IP 192.168.3.100.35040 > 192.168.3.125.21: S 2364572529:2364572529(0) win 5840
14:40:10.633417 IP 192.168.3.125.21 > 192.168.3.100.35040: S 1098201604:1098201604(0) ack 2364572530 win 5792
14:40:10.633649 IP 192.168.3.100.35040 > 192.168.3.125.21: . ack 1 win 46
14:40:10.638336 IP 192.168.3.125.21 > 192.168.3.100.35040: P 1:21(20) ack 1 win 46
14:40:10.638647 IP 192.168.3.100.35040 > 192.168.3.125.21: . ack 21 win 46
14:40:10.638767 IP 192.168.3.100.35040 > 192.168.3.125.21: P 1:16(15) ack 21 win 46
14:40:10.638978 IP 192.168.3.125.21 > 192.168.3.100.35040: . ack 16 win 46
14:40:10.638987 IP 192.168.3.125.21 > 192.168.3.100.35040: P 21:55(34) ack 16 win 46
14:40:10.639194 IP 192.168.3.100.35040 > 192.168.3.125.21: P 16:23(7) ack 55 win 46
14:40:10.678120 IP 192.168.3.125.21 > 192.168.3.100.35040: . ack 23 win 46
14:40:13.336251 IP 192.168.3.125.21 > 192.168.3.100.35040: P 55:77(22) ack 23 win 46
14:40:13.336587 IP 192.168.3.100.35040 > 192.168.3.125.21: P 23:29(6) ack 77 win 46
14:40:13.336715 IP 192.168.3.125.21 > 192.168.3.100.35040: . ack 29 win 46
14:40:13.338041 IP 192.168.3.125.21 > 192.168.3.100.35040: P 77:91(14) ack 29 win 46
14:40:13.338056 IP 192.168.3.125.21 > 192.168.3.100.35040: F 91:91(0) ack 29 win 46
14:40:13.338850 IP 192.168.3.100.35040 > 192.168.3.125.21: F 29:29(0) ack 92 win 46
14:40:13.339621 IP 192.168.3.125.21 > 192.168.3.100.35040: . ack 30 win 46

asg and ubuntu are guest on esxi it was working but after some ips update it seems not working before it was giving ips alert

thanks
if u want login dtls for both system pls let me know
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data