This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Strange IPS detection

Hey everbody,

I've got a strange IPS detection.

[HTML]2009:03:20-19:50:40 (none) barnyard[9004]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="alert" reason="BACKDOOR fkwp 2.0 runtime detection - connection success" group="510" srcip="192.168.178.1" dstip="192.168.178.93" proto="6" srcport="8110" dstport="1081" sid="6033" class="A Network Trojan was detected" priority="1" generator="1" msgid="0"
2009:03:20-19:50:40 (none) barnyard[9004]: id="2101" severity="warn" sys="SecureNet" sub="ips" name="Intrusion protection alert" action="drop" reason="BACKDOOR fkwp 2.0 runtime detection - connection attempt server-to-client" group="510" srcip="192.168.178.1" dstip="192.168.178.93" proto="6" srcport="8110" dstport="1081" sid="6031" class="A Network Trojan was detected" priority="1" generator="1" msgid="0"[/HTML]

The strange is that the source and the destitionation IPs are in the same range! What does that mean? I always thought that traffic will got through my firewall and not be initiated from my firewall!

Could me anybody tell whats going on?

cheers

PSyc

This thread was automatically locked due to age.

Parents

0 wingman over 16 years ago

A Network Trojan was detected" priority

I think your client is infected
Cancel
Vote Up 0 Vote Down

Cancel
0 PSyc over 16 years ago in reply to wingman

Hi wingman,

thanks for reply!

I'm not sure if my client is infected because several tools I've used didn't find an infection .. yes I know that's not a sign therefore that my host is clean!

This alert only appear one time, shouldn't it not appear more often if my host infected?

Why to connection to my host was established my gateway (astaro), I mean this is strange in my point of view?

Anyway thanks for feedback!

cheers
Cancel
Vote Up 0 Vote Down

Cancel
0 wingman over 16 years ago in reply to PSyc

can you provide more information about the specific hosts and your network?
Cancel
Vote Up 0 Vote Down

Cancel
0 PSyc over 16 years ago in reply to wingman

sure can do, what for information do you want?

cheers
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 16 years ago in reply to PSyc

What do you have at .178.1 and .178.93?

Is it possible that the infection was already cleadned by an anti-virus running on .187.1?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 PSyc over 16 years ago in reply to BAlfson

.178.1 is the astaro .178.93 is the host.

cheers

psyc
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 PSyc over 16 years ago in reply to BAlfson

.178.1 is the astaro .178.93 is the host.

cheers

psyc
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data