April 2017
Intermediate to advanced
350 pages
8h 35m
English
The following is the example of a Snort alert for this ICMP rule:
root@vishnu:~# head /var/log/snort/alert [**] [1:2925:3] INFO web bug 0x0 gif attempt [**] [Classification: Misc activity] [Priority: 3] 12/02-17:08:40.479756 107.20.221.156:80 -> 192.168.1.64:55747 TCP TTL:42 TOS:0x0 ID:14611 IpLen:20 DgmLen:265 DF ***AP*** Seq: 0x6C1242F9 Ack: 0x74B1A5FE Win: 0x2E TcpLen: 32 TCP Options (3) => NOP NOP TS: 1050377198 1186998 [**] [1:368:6] ICMP PING BSDtype [**] [Classification: Misc activity] [Priority: 3] 12/02-17:09:01.112440 192.168.1.14 -> 192.168.1.64
Read now
Unlock full access