Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 17 replies
  • Subscribers 2 subscribers
  • Views 29123 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Strange IPS detection

PSyc
Hey everbody,

I've got a strange IPS detection.

[HTML]2009:03:20-19:50:40 (none) barnyard[9004]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="BACKDOOR fkwp 2.0 runtime detection - connection success" group="510" srcip="192.168.178.1" dstip="192.168.178.93" proto="6" srcport="8110" dstport="1081" sid="6033" class="A Network Trojan was detected" priority="1"  generator="1" msgid="0"
2009:03:20-19:50:40 (none) barnyard[9004]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="BACKDOOR fkwp 2.0 runtime detection - connection attempt server-to-client" group="510" srcip="192.168.178.1" dstip="192.168.178.93" proto="6" srcport="8110" dstport="1081" sid="6031" class="A Network Trojan was detected" priority="1"  generator="1" msgid="0"[/HTML]

The strange is that the source and the destitionation IPs are in the same range! What does that mean? I always thought that traffic will got through my firewall and not be initiated from my firewall!

Could me anybody tell whats going on?


cheers

PSyc


This thread was automatically locked due to age.
Parents
  • 0
    A Network Trojan was detected" priority

    I think your client is infected
  • 0 in reply to wingman
    Hi wingman,

    thanks for reply!

    I'm not sure if my client is infected because several tools I've used didn't find an infection .. yes I know that's not a sign therefore that my host is clean!

    This alert only appear one time, shouldn't it not appear more often if my host infected?

    Why to connection to my host was established my gateway (astaro), I mean this is strange in my point of view?

    Anyway thanks for feedback!


    cheers
Reply
  • 0 in reply to wingman
    Hi wingman,

    thanks for reply!

    I'm not sure if my client is infected because several tools I've used didn't find an infection .. yes I know that's not a sign therefore that my host is clean!

    This alert only appear one time, shouldn't it not appear more often if my host infected?

    Why to connection to my host was established my gateway (astaro), I mean this is strange in my point of view?

    Anyway thanks for feedback!


    cheers
Children