IPS logs show no relevant information and ATP shows no log entry.
We put the host in the list of exceptions to IPS and access have been standardized. When we activate the ATP, even with the host in the exception, the problem returns. Can simulate the problem?
We put all the Attack Patterns in the Alert mode and still the problem occurs.
The only relevant alert that we've seen in the logs was the below, but the internal IP of our server is 10.97.100.49 and the external IP address (NAT) 201.49.58.249.
2015:04:15-09:04:53 i-slot04-2 snort[22708]: S5: Session exceeded configured max bytes to queue 1048576 using 1052204 bytes (client queue). 66.249.64.50 39001 --> 10.97.100.6 80 (0) : LWstate 0xf LWFlags 0x6007
2015:04:15-09:06:32 i-slot04-2 snort[22706]: S5: Session exceeded configured max bytes to queue 1048576 using 1061842 bytes (client queue). 66.249.88.253 51707 --> 10.97.100.6 80 (0) : LWstate 0x48 LWFlags 0x406107
2015:04:15-09:08:05 i-slot04-2 snort[22709]: S5: Session exceeded configured max bytes to queue 1048576 using 1054076 bytes (client queue). 66.249.88.129 59617 --> 10.97.100.6 80 (0) : LWstate 0x9 LWFlags 0x6007
2015:04:15-09:08:50 i-slot04-2 snort[22709]: S5: Session exceeded configured max bytes to queue 1048576 using 1054420 bytes (client queue). 95.94.18.168 53320 --> 10.97.100.7 80 (0) : LWstate 0x9 LWFlags 0x6007
2015:04:15-09:12:23 i-slot04-2 snort[22709]: S5: Session exceeded configured max bytes to queue 1048576 using 1050332 bytes (client queue). 66.249.83.235 43975 --> 10.97.100.23 80 (0) : LWstate 0x9 LWFlags 0x6007
2015:04:15-09:12:40 i-slot04-2 snort[22709]: S5: Session exceeded configured max bytes to queue 1048576 using 1048990 bytes (client queue). 66.249.88.129 33331 --> 10.97.100.6 80 (0) : LWstate 0x9 LWFlags 0x6007
2015:04:15-09:15:53 i-slot04-2 snort[22709]: S5: Session exceeded configured max bytes to queue 1048576 using 1049122 bytes (client queue). 66.249.83.235 63558 --> 10.97.100.23 80 (0) : LWstate 0x9 LWFlags 0x6007
2015:04:15-09:17:07 i-slot04-2 snort[22709]: S5: Session exceeded configured max bytes to queue 1048576 using 1049448 bytes (client queue). 179.187.158.49 38524 --> 10.97.100.7 80 (0) : LWstate 0x9 LWFlags 0x6007
2015:04:15-09:19:02 i-slot04-2 snort[22709]: S5: Session exceeded configured max bytes to queue 1048576 using 1054638 bytes (client queue). 66.249.83.235 61068 --> 10.97.100.23 80 (0) : LWstate 0x9 LWFlags 0x6007
This thread was automatically locked due to age.