Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- **********************************
- alert.json:
- {"timestamp":"2015-09-16T08:07:25.916066-0500","flow_id":140478720631792,"event_type":"alert","vlan":95,"src_ip":"180.190.93.213","src_port":7748,"dest_ip":"192.168.1.1","dest_port":3306,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2010937,"rev":2,"signature":"ET POLICY Suspicious inbound to mySQL port 3306","category":"Potentially Bad Traffic","severity":2},"payload":"","payload_printable":"","stream":0,"packet":"EF8IAgAAChYAJUU4jyIACOP\/\/ZAIAEUAADAakUAAbAYeILS+XdWcYichHkQM6nHWa5AAAAAAcAL\/\/6SlAAACBAWCAQEEAg=="}
- **********************************
- alert debug:
- TIME: 09/16/2015-08:07:25.916066
- PKT SRC: gre tunnel
- SRC IP: 180.190.93.213
- DST IP: 192.168.1.1
- PROTO: 6
- SRC PORT: 7748
- DST PORT: 3306
- TCP SEQ: 1909877648
- TCP ACK: 0
- FLOW: to_server: TRUE, to_client: FALSE
- FLOW Start TS: 09/16/2015-08:07:25.916066
- FLOW PKTS TODST: 1
- FLOW PKTS TOSRC: 0
- FLOW Total Bytes: 70
- FLOW IPONLY SET: TOSERVER: TRUE, TOCLIENT: FALSE
- FLOW ACTION: DROP: FALSE
- FLOW NOINSPECTION: PACKET: FALSE, PAYLOAD: FALSE, APP_LAYER: FALSE
- FLOW APP_LAYER: DETECTED: FALSE, PROTO 0
- PACKET LEN: 70
- PACKET:
- 0000 10 5F 08 02 00 00 0A 16 00 25 45 38 8F 22 00 08 ._...... .%E8."..
- 0010 E3 FF FD 90 08 00 45 00 00 30 1A 91 40 00 6C 06 ......E. [email protected].
- 0020 1E 20 B4 BE 5D D5 9C 62 27 21 1E 44 0C EA 71 D6 . ..]..b '!.D..q.
- 0030 6B 90 00 00 00 00 70 02 FF FF A4 A5 00 00 02 04 k.....p. ........
- 0040 05 82 01 01 04 02 ......
- ALERT CNT: 1
- ALERT MSG [00]: ET POLICY Suspicious inbound to mySQL port 3306
- ALERT GID [00]: 1
- ALERT SID [00]: 2010937
- ALERT REV [00]: 2
- ALERT CLASS [00]: Potentially Bad Traffic
- ALERT PRIO [00]: 2
- ALERT FOUND IN [00]: PACKET
- ALERT IN TX [00]: N/A
- **********************************
- Scapy output (after decode):
- <Ether dst=10:5f:08:02:00:00 src=0a:16:00:25:45:38 type=0x8f22 |<Raw load="\x00\x08\xe3\xff\xfd\x90\x08\x00E\x00\x000\x1a\x91@\x00l\x06\x1e \xb4\xbe]\xd5\x9cb'!\x1eD\x0c\xeaq\xd6k\x90\x00\x00\x00\x00p\x02\xff\xff\xa4\xa5\x00\x00\x02\x04\x05\x82\x01\x01\x04\x02" |>>
Advertisement
Add Comment
Please, Sign In to add comment