[Dshield] dshield ignoring webserver, dns server, etc. when addressed correctly

Security Dude security at digital-magick.com
Tue Nov 12 23:24:58 GMT 2002


Can some kind soul tell me where I am missing the boat as far as
having dshield snort_18_syslog.pl stop sending reports on access that
is appropriate for a particular server?  (and of course in the
following example the ip's have been changed to protect the innocent)

not helpful to the outgoing email sent to dshield:
web server at 127.0.0.25 is accessed on port 80 by anyone.
dns server at 127.0.0.26 is accessed on port 53 by anyone.

helpful to the outgoing email
dns server at 127.0.0.26 is accessed on port 80 by anyone.
web server at 127.0.0.25 is accessed on port 53 by anyone.

Thanks!


Digital-Magick Media
When mundane is not enough
(801)748-0055
49 W Center St, Midvale, UT, 84047, USA
magick at digital-magick.com




More information about the list mailing list