SnortSnarf alert page

Destination: (no IP)

SnortSnarf v020516.1

Signature section (54)

Top 20 source IPs

Top 20 dest IPs

36 such alerts found using input module SnortFileInput, with sources:

/var/log/snort/alert

Earliest: 06:45:08 on 7/23/2005
Latest: 21:55:54 on 7/23/2005

2 different signatures are present for (no IP) as a destination

2 instances of (snort_decoder) WARNING: Not IPv4 datagram!
34 instances of (spp_arpspoof) Attempted ARP cache overwrite attack

There are 1 distinct source IPs in the alerts of the type on this page.

See also (no IP) as an alert source [36 alerts]

Jul 23 06:45:08 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 07:14:52 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 09:04:20 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 09:48:21 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 12:15:30 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 12:16:50 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 12:19:11 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 12:19:21 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 12:27:31 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 12:34:37 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 12:34:47 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 16:13:51 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 16:43:12 lucretia snort: (snort_decoder) WARNING: Not IPv4 datagram!

Jul 23 16:57:01 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 16:58:06 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 16:58:54 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 16:59:53 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 17:00:17 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 17:07:02 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 17:25:21 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 17:25:33 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 17:38:33 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 17:38:41 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 18:14:27 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 18:14:34 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 18:33:55 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 18:34:07 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 19:27:43 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 19:27:48 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 19:35:47 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 19:50:01 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 19:55:21 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 20:18:47 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 21:27:55 lucretia snort: (snort_decoder) WARNING: Not IPv4 datagram!

Jul 23 21:50:00 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

Jul 23 21:55:54 lucretia snort: (spp_arpspoof) Attempted ARP cache overwrite attack

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Sat Jul 23 22:10:12 2005