wiki:icasIII

Version 1 (modified by waue, 13 years ago) (diff)

--

[] [1:2189:3] BAD-TRAFFIC IP Proto 103 PIM [] [Classification: Detection of a non-standard protocol or event] [Priority: 2] 05/17-08:30:14.750704 140.110.138.253 -> 224.0.0.13 PIM TTL:1 TOS:0xC0 ID:4076 IpLen:20 DgmLen:58 [Xref => ​http://cve.mitre.org/cgi-bin/cvename.cgi?name=2003-0567][Xref => ​http://www.securityfocus.com/bid/8211]

=>

1;2189;3;BAD-TRAFFIC IP Proto 103 PIM ;Detection of a non-standard protocol or event;2;05;17;08;30;14;140.110.138.253;224.0.0.13;PIM; 1;100000160;2;COMMUNITY SIP TCP/IP message flooding directed to SIP proxy ;Attempted Denial of Service;2;05;17;08;30;21;140.110.138.191:24800;140.110.138.193:60347;TCP;

=＝

可能是網卡編號（不確定也沒用到）;snort警訊識別id ; sid的版本 ; 說明 ; 分類 ; 嚴重性（1最嚴重） ; 月 ; 日 ; 時 ; 分 ; 秒 ; 來源ip ; 目標ip ; 封包協定 ;

Attachments (2)

Download all attachments as: .zip