Tagged Questions
4
votes
1answer
256 views
Outbound TFTP request to 255.255.255.255
Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255
Anyone have a clue as to what this may ...
0
votes
1answer
92 views
Is there a Snort rule that equates to “something suspicious flagged from a client side application?”
The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
0
votes
2answers
240 views
Unexplained downloading
I was just watching as my bandwidth monitor spiked downloading a file. I checked my current netstat and I didn't recognize one of the IPs so I started capturing the data with Wireshark.
The ...
3
votes
2answers
132 views
Automatic harvesting of hacked hosts and reporting to domain/site admin
With so many internet attacks out there, I just think it would be convenient (and quicker and wise) if there is a way to automatically harvest the hacked hosts that are used to launch internet ...
6
votes
1answer
2k views
High concentration of UDP traffic, good or bad?
Should a network have a high concentration of UDP traffic compared to TCP traffic bad for a network especially in the context of network security?
I'm looking at my organization's network protocol ...
