Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Replies 5 replies
  • Subscribers 0 subscribers
  • Views 2341 views
  • Users 0 members are here
Options
Suggested

[8.940][ANSWERED] IPS reporting

RFCat_vk_01
According to the daily report my sons internal PC is attacking an external website.

I don't believe this is correct.

I have attached an extract from the daily report.

Ian
Parents Reply Children
  • 0 in reply to kbr
    Hi Kai,
    I will try again, the PC died.
    The source is possibly the world of warcraft game, I get this message when from both PCs when they play the game. Part of this software was downloaded while the http proxy was playing up. Yes, I know the risks of using beta software, but how else do you test it?
    I have also included some line that don't report out in the daily IPS report.
      
     2012:05:03-06:44:25 cats-kingdom ulogd[4452]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="ppp0" srcip="116.197.146.63" dstip="124.168.222.222" proto="17" length="1308" tos="0x0c" prec="0x20" ttl="59" srcport="3653" dstport="55867" 
     2012:05:03-06:44:25 cats-kingdom ulogd[4452]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="ppp0" srcip="116.197.146.63" dstip="124.168.222.222" proto="17" length="1308" tos="0x0c" prec="0x20" ttl="59" srcport="3653" dstport="55867"  
    2012:05:03-06:44:26 cats-kingdom ulogd[4452]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="ppp0" srcip="116.197.146.63" dstip="124.168.222.222" proto="17" length="1308" tos="0x0c" prec="0x20" ttl="59" srcport="3653" dstport="55867"  
    2012:05:03-06:44:26 cats-kingdom ulogd[4452]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="ppp0" srcip="116.197.146.63" dstip="124.168.222.222" proto="17" length="1308" tos="0x0c" prec="0x20" ttl="59" srcport="3653" dstport="55867"  
    2012:05:03-19:13:22 cats-kingdom snort[5955]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="PUA-P2P BitTorrent announce request" group="500" srcip="192.168.10.250" dstip="12.129.222.51" proto="6" srcport="49294" dstport="3724" sid="2180" class="Potential Corporate Privacy Violation" priority="1"  generator="1" msgid="0" 
    2012:05:03-19:13:24 cats-kingdom snort[5955]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="PUA-P2P BitTorrent announce request" group="500" srcip="192.168.10.250" dstip="12.129.222.51" proto="6" srcport="49295" dstport="3724" sid="2180" class="Potential Corporate Privacy Violation" priority="1"  generator="1" msgid="0" 
    2012:05:03-19:13:26 cats-kingdom snort[5955]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="PUA-P2P BitTorrent announce request" group="500" srcip="192.168.10.250" dstip="12.129.222.51" proto="6" srcport="49305" dstport="3724" sid="2180" class="Potential Corporate Privacy Violation" priority="1"  generator="1" msgid="0" 
    2012:05:03-19:13:30 cats-kingdom snort[5955]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="PUA-P2P BitTorrent announce request" group="500" srcip="192.168.10.250" dstip="12.129.222.51" proto="6" srcport="49308" dstport="3724" sid="2180" class="Potential Corporate Privacy Violation" priority="1"  generator="1" msgid="0" 
    2012:05:03-19:13:31 cats-kingdom snort[5955]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="PUA-P2P BitTorrent announce request" group="500" srcip="192.168.10.250" dstip="12.129.222.51" proto="6" srcport="49309" dstport="3724" sid="2180" class="Potential Corporate Privacy Violation" priority="1"  generator="1" msgid="0" 
    2012:05:03-19:29:48 cats-kingdom snort[5955]: S5: Session exceeded configured max segs to queue 2621 using 2621 segs (client queue). 192.168.10.250 49325 --> 12.129.223.124 3724 (0) : LWstate 0x9 LWFlags 0x6007 
    2012:05:03-19:52:14 cats-kingdom snort[5955]: S5: Session exceeded configured max segs to queue 2621 using 2621 segs (client queue). 192.168.10.250 49330 --> 12.129.254.217 3724 (0) : LWstate 0x9 LWFlags 0x406007 
    2012:05:03-20:27:33 cats-kingdom snort[5955]: S5: Session exceeded configured max segs to queue 2621 using 2621 segs (client queue). 192.168.10.250 50254 --> 175.45.88.239 20077 (0) : LWstate 0x9 LWFlags 0x6007

    I have not been able to find anything close in the http log.
  • 0 in reply to RFCat_vk_01
    Hi Ian,

    Snort ID 2180 is generated when network traffic that indicates BitTorrent is being used.

    The use of BitTorrent may be prohibited by corporate policy in some network environments.

    So if you like you can set the rule to 'alert only' or disable it completely in the webinterface:
    Network Protection>Intrusion Prevention>Advanced>Modified rules

    I hope this was helpful,
    Lukas
  • 0 in reply to lmatt
    The report about the bittorrent is correct I expect, seeing it only happens when my sons play WOW and it is always the same server. They do complain about the ping, so changing the IPS rule setting might fix some of that.

    But doesn't explain the flood not being reported?

    Ian
  • 0 in reply to lmatt
    Snort ID 2180 is generated when network traffic that indicates BitTorrent is being used.


    Hi, I don't really understand why an IPS rule would be enabled by default which blocks applications, especially when I've already enabled BitTorrent under Application Control.

    At least, these Snort rules should be put in a new Attack Pattern section called "Corporate Policy" or something like that.

    Thanks,
    Barry
Unfiltered HTML