thelinuxlink.net

I was wondering anybody has seen snort produce this kind of output before.

Events from same host to same destination using same method
=========================================================================
# of from to method
=========================================================================
10 192.168.xxx.xxx 216.39.69.100 (portscan) TCP Portscan
8 192.168.xxx.xxx 216.39.69.100 (portscan) TCP Portsweep
6 192.168.xxx.xxx 194.129.79.6 (portscan) TCP Portsweep
6 192.168.xxx.xxx 194.129.79.6 (portscan) TCP Portscan
2 192.168.xxx.xxx 216.39.69.77 (portscan) TCP Portsweep
2 192.168.xxx.xxx 216.39.69.77 (portscan) TCP Portscan

the 192 address is my local machine so the port scans/sweeps are coming from my computer.
could this possibly something like a zombie or something phoning home. because I did not do any kind of port snooping when this report was created. nmap isn't even on the box.

I guess what worries me is that the 194 address is owned by an isp in amsterdam and the 216 address is owned by savis. and I have nothing to do with those isps.

anyway during this time I went to the stealth port detection site to test my box and I am thinking maybe that has something to do with it but I am not sure and I don't see any of those ip's associated with that site. but I have never seen this before and this box has been up for months.

I take it you are running snort in daemon mode? What is your syntax for that, the output I get from snort does not match what you have posted.

Anyway, what site were you going to for port testing? It is possible this site is making use of services in those locations for the testing, but maybe not. Why not repeate the process and monitor your logs to see if the same behavior occurs.

Went to shields up

http://grc.com/su-danger.htm

and yes it is running in daemon mode

sorry should of provided more info - I am just running a pretty much stock ubuntu 5.10 distro with snort installed through synaptic.

here is the line in the init.d file that starts it - I am just using the start script that came with the distro

/sbin/start-stop-daemon --start --quiet --pidfile "$PIDFILE" \
--exec $DAEMON -- $COMMON $DEBIAN_SNORT_OPTIONS \

and ya I was going to wait a few more days to see if it shows up again and then run the test again and see if I get the same output again.

I sort of have a feeling that this is it. tripwire and chkrookit haven't reported anything and the logs look normal from those two programs.

thanks for your response and I am in the middle of listening to last weeks show and it is hilarious.