SnortALog Report

IDS Statistics generated on Sun Nov 27 08:20:XX 2005

The log begins at :	Aug 28 07:09:18
The log ends at :	Aug 29 09:08:02

Total of Lines in log file :	58
Total of Logs Dropped :	0 (0.00%)


Total events in table :	58
Source IP recorded :	7
Destination IP recorded :	2

NIDS recorded :	1 with 1 interface(s)
Signatures recorded :	2
Classification recorded :	2
Severity recorded :	2
Portscan detected :	0

Domains File :	/tmp/domains
Number of domains :	267
Rules File :	/tmp/rules
Number of referenced rules :	1351

Legend :
	RED :	Dangerous connections (potentially bad, further investigation needed!)
	GREEN :	Warning connections (strange, may need further intevestigation!)
	BLACK :	Not dangerous alert

General Statistics

The distribution of event by hour

The distribution of event by day

Popularity of one source host

Popularity of one destination host

The distribution of event by destination port

The distribution of event by protocols

The distribution of event type of log

Specific Statistics

Events from one host to any with same method

Events to one host from any with same method

Events from a host to a destination

Events to one destination port grouped by attack

Distribution of attack methods

Distribution of classification method

The distribution of event by severity

Events by hour

The distribution of event by protocols

%	No	Protocols
81.03	47	tcp
18.97	11	icmp

The distribution of severity

%	No	Severity
81.03	47	medium
18.97	11	low

The distribution of attack by hour

Hour	No	%	Graph
0h	3	5.17
4h	2	3.XX
5h	1	1.72
6h	1	1.72
7h	2	3.XX
8h	1	1.72
9h	4	6.90
10h	1	1.72
13h	2	3.XX
14h	1	1.72
15h	6	10.34
16h	2	3.XX
17h	2	3.XX
18h	5	8.62
19h	3	5.17
20h	5	8.62
XXXh	6	10.34
22h	6	10.34
23h	5	8.62

The distribution of event by day

Day	Month	No	%	Graph
28	8	46	79.31
29	8	12	20.69

Distribution of event by destination port

%	No	Destination Port
18.97	11	0
6.90	4	1797
5.17	3	1524
5.17	3	1038
5.17	3	1695
3.XX	2	1735
3.XX	2	1389
3.XX	2	1938
3.XX	2	1935
3.XX	2	1431
3.XX	2	1196
1.72	1	1079
1.72	1	1753
1.72	1	OOO0
1.72	1	1875
1.72	1	1OOO
1.72	1	1776
1.72	1	1999
1.72	1	1817
1.72	1	OOO9
1.72	1	1310
1.72	1	1694
1.72	1	1876
1.72	1	OOO7
1.72	1	1262
1.72	1	1975
1.72	1	1671
1.72	1	1991
1.72	1	1463
1.72	1	10XX
1.72	1	1OOO2
1.72	1	1318
1.72	1	1175

To see the popularity of one source host

%	No	IP Source	Resolve	Domain
81.03	47	OOO.OOO.OOO.OOO	localhost
6.90	4	OOO.197.57.77	pl8XX.nas927.n-yokohama.nttpc.ne.jp	Japan
3.XX	2	72.XXX.40.10	lists.centos.org	Non-Profit
3.XX	2	66.35.250.12	getafix.vasoftware.com	US Commercial
1.72	1	59.106.33.172	esmtp3.stand.ne.jp	Japan
1.72	1	59.106.41.XX	n2.59-106-41-XX.mixi.jp	Japan
1.72	1	59.106.33.174	esmtp5.stand.ne.jp	Japan

Percentage and number of attacks from one host to any with same method

%	No	IP Source	Attack	Severity
81.03	47	OOO.OOO.OOO.OOO	BAD-TRAFFIC loopback traffic {tcp}	medium
6.90	4	OOO.197.57.77	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}	low
3.XX	2	66.35.250.12	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}	low
3.XX	2	72.XXX.40.10	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}	low
1.72	1	59.106.33.174	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}	low
1.72	1	59.106.41.XX	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}	low
1.72	1	59.106.33.172	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}	low

To see the popularity of one destination host

%	No	IP Destination	Resolve
81.03	47	OOO.OOO.OOO.OOO	insanity.as.wakwak.ne.jp
18.97	11	YYY.YYY.YYY.YYY	lucretia.honto.info

Percentage and number of attacks to one host from any with same method

%	No	IP Destination	Attack	Severity
81.03	47	OOO.OOO.OOO.OOO	BAD-TRAFFIC loopback traffic {tcp}	medium
18.97	11	YYY.YYY.YYY.YYY	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}	low

Percentage and number of attacks from a host to a destination

%	No	IP Source	IP Destination	Attack
81.03	47	OOO.OOO.OOO.OOO	OOO.OOO.OOO.OOO	BAD-TRAFFIC loopback traffic {tcp}
6.90	4	OOO.197.57.77	YYY.YYY.YYY.YYY	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
3.XX	2	72.XXX.40.10	YYY.YYY.YYY.YYY	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
3.XX	2	66.35.250.12	YYY.YYY.YYY.YYY	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
1.72	1	59.106.33.172	YYY.YYY.YYY.YYY	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
1.72	1	59.106.33.174	YYY.YYY.YYY.YYY	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
1.72	1	59.106.41.XX	YYY.YYY.YYY.YYY	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}

The distribution of attack methods

%	No	Attack	Priority	Severity
81.03	47	BAD-TRAFFIC loopback traffic {tcp}	2	medium
18.97	11	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}	3	low

The distribution of classification method

%	No	Classification	Severity
81.03	47	Potentially Bad Traffic	medium
18.97	11	Misc activity	low

Percentage and number of attacks by hour

%	No	Hour	Attack
10.34	6	22h	BAD-TRAFFIC loopback traffic {tcp}
10.34	6	15h	BAD-TRAFFIC loopback traffic {tcp}
8.62	5	23h	BAD-TRAFFIC loopback traffic {tcp}
8.62	5	XXXh	BAD-TRAFFIC loopback traffic {tcp}
6.90	4	18h	BAD-TRAFFIC loopback traffic {tcp}
6.90	4	20h	BAD-TRAFFIC loopback traffic {tcp}
5.17	3	0h	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	9h	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	7h	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
3.XX	2	13h	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	9h	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
3.XX	2	17h	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	19h	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	4h	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	20h	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
1.72	1	5h	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	10h	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	19h	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
1.72	1	16h	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	16h	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
1.72	1	XXXh	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
1.72	1	6h	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
1.72	1	18h	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
1.72	1	14h	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	8h	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}

Percentage and number of attacks to one destination port

%	No	Port	Attack
18.97	11	0	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited {icmp}
6.90	4	1797	BAD-TRAFFIC loopback traffic {tcp}
5.17	3	1524	BAD-TRAFFIC loopback traffic {tcp}
5.17	3	1695	BAD-TRAFFIC loopback traffic {tcp}
5.17	3	1038	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	1735	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	1389	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	1938	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	1431	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	1935	BAD-TRAFFIC loopback traffic {tcp}
3.XX	2	1196	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1310	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1991	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	OOO0	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1694	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1463	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1262	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	OOO7	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1318	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1875	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	OOO9	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1OOO2	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1999	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1876	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1817	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1975	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1671	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1079	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1753	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1776	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	10XX	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1OOO	BAD-TRAFFIC loopback traffic {tcp}
1.72	1	1175	BAD-TRAFFIC loopback traffic {tcp}

Number of occurrences by type of log

%	No	Type
100.00	58	snort_signature

Generated by SnortALog Version: 2.2.1 ( Date: 2004/04/30 17:19:00 ) Jeremy CHARTIER