<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div style="color: rgb(0, 0, 0); ">Hi all,</div>
<div style="color: rgb(0, 0, 0); ">I have here…</div>
<div style="color: rgb(0, 0, 0); ">Executing: suricata --user sguil --group sguil -c /etc/nsm/Wecker-intern/suricata.yaml -q 1 -l /nsm/sensor_data/Wecker-intern</div>
<div style="color: rgb(0, 0, 0); ">
<div>22/8/2013 -- 06:00:26 - <Info> - This is Suricata version 1.4.5 RELEASE</div>
<div>22/8/2013 -- 06:00:26 - <Info> - CPUs/cores online: 4</div>
<div>22/8/2013 -- 06:00:26 - <Info> - Enabling fail-open on queue</div>
<div>22/8/2013 -- 06:00:26 - <Info> - NFQ running in standard ACCEPT/DROP mode</div>
</div>
<div style="color: rgb(0, 0, 0); "><br>
</div>
<div style="color: rgb(0, 0, 0); "><span id="Dst[0][0:3:0:3]" _mstsrc="0_0:3" _mstdst="0_0:3" class="" style="white-space: pre-wrap; ">Have</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][10:12:5:5]" _mstsrc="0_10:12" _mstdst="0_5:5" class="" style="white-space: pre-wrap; ">a</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][14:20:7:13]" _mstsrc="0_14:20" _mstdst="0_7:13" class="" style="white-space: pre-wrap; ">problem</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][22:24:15:18]" _mstsrc="0_22:24" _mstdst="0_15:18" class="" style="white-space: pre-wrap; ">with</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][26:30:20:20]" _mstsrc="0_26:30" _mstdst="0_20:20" class="" style="white-space: pre-wrap; ">a</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][32:36:22:25]" _mstsrc="0_32:36" _mstdst="0_22:25" class="" style="white-space: pre-wrap; ">rule,</span><span style="white-space: pre-wrap; "> i</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][46:50:29:33]" _mstsrc="0_46:50" _mstdst="0_29:33" class="" style="white-space: pre-wrap; ">don't</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][52:59:35:44]" _mstsrc="0_52:59" _mstdst="0_35:44" class="" style="white-space: pre-wrap; ">understand</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][5:8:46:49]" _mstsrc="0_5:8" _mstdst="0_46:49" class="" style="white-space: pre-wrap; ">here</span><span style="white-space: pre-wrap; ">.</span></div>
<div style="color: rgb(0, 0, 0); "><span id="Dst[0][0:5:0:7]" _mstsrc="0_0:5" _mstdst="0_0:7" class="" style="white-space: pre-wrap; ">Although</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][7:11:9:12]" _mstsrc="0_7:11" _mstdst="0_9:12" class="" style="white-space: pre-wrap; ">this</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][13:17:14:17]" _mstsrc="0_13:17" _mstdst="0_14:17" class="" style="white-space: pre-wrap; ">rule</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][19:21:19:20]" _mstsrc="0_19:21" _mstdst="0_19:20" class="" style="white-space: pre-wrap; ">on</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][23:27:22:26]" _mstsrc="0_23:27" _mstdst="0_22:26" class="" style="white-space: pre-wrap; ">alert marks</span><span style="white-space: pre-wrap; ">,</span><span style="white-space: pre-wrap; ">
</span><span id="Dst[0][36:39:29:32]" _mstsrc="0_36:39" _mstdst="0_29:32" class="" style="white-space: pre-wrap; ">drop</span><span style="white-space: pre-wrap; "> suricata</span><span style="white-space: pre-wrap; "> the
</span><span id="Dst[0][47:51:36:39]" _mstsrc="0_47:51" _mstdst="0_36:39" class="" style="white-space: pre-wrap; ">data stream</span><span style="white-space: pre-wrap; ">.</span></div>
<div><span id="Dst[0][0:3:0:1]" _mstsrc="0_0:3" _mstdst="0_0:1" class="" style="color: rgb(0, 0, 0); white-space: pre-wrap; ">If</span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; "> i</span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; ">
</span><span id="Dst[0][19:29:5:11]" _mstsrc="0_19:29" _mstdst="0_5:11" class="" style="color: rgb(0, 0, 0); white-space: pre-wrap; ">disable</span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; ">
</span><span id="Dst[0][9:11:13:15]" _mstsrc="0_9:11" _mstdst="0_13:15" class="" style="color: rgb(0, 0, 0); white-space: pre-wrap; ">the</span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; ">
</span><span id="Dst[0][13:17:17:20]" _mstsrc="0_13:17" _mstdst="0_17:20" class="" style="color: rgb(0, 0, 0); white-space: pre-wrap; ">rule</span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; ">,</span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; ">
</span><span id="Dst[0][39:41:23:25]" _mstsrc="0_39:41" _mstdst="0_23:25" class="" style="color: rgb(0, 0, 0); white-space: pre-wrap; ">the</span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; ">
</span><span id="Dst[0][43:47:27:30]" _mstsrc="0_43:47" _mstdst="0_27:30" class="" style="color: rgb(0, 0, 0); white-space: pre-wrap; ">data</span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; ">
</span><span id="Dst[0][32:37:32:34]" _mstsrc="0_32:37" _mstdst="0_32:34" class="" style="color: rgb(0, 0, 0); white-space: pre-wrap; ">are</span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; ">
</span><span style="white-space: pre-wrap; ">forwarded (not drop) </span><span style="color: rgb(0, 0, 0); white-space: pre-wrap; ">.</span></div>
<div style="color: rgb(0, 0, 0); "><span style="white-space: pre-wrap; "><br>
</span></div>
<div style="color: rgb(0, 0, 0); "><span style="white-space: pre-wrap; ">Why ?</span></div>
<div style="color: rgb(0, 0, 0); "><span style="white-space: pre-wrap; ">Any idea?</span></div>
<div style="color: rgb(0, 0, 0); "><span style="white-space: pre-wrap; "><br>
</span></div>
<div style="color: rgb(0, 0, 0); "><span style="white-space: pre-wrap; ">Thx</span></div>
<div style="color: rgb(0, 0, 0); "><span style="white-space: pre-wrap; ">Stefan</span></div>
<div style="color: rgb(0, 0, 0); "><br>
</div>
<div style="color: rgb(0, 0, 0); ">rules:</div>
<div style="color: rgb(0, 0, 0); ">
<div>alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Vulnerable Java Version 1.6.x Detected"; flow:established,to_server; content:"Java/1.6.0_"; ht</div>
<div>tp_user_agent; content:!"51"; within:2; http_user_agent; flowbits:set,ET.http.javaclient.vulnerable; threshold: type limit, count 2, seconds 300, track by_s</div>
<div>rc; reference:url,javatester.org/version.html; classtype:bad-unknown; sid:2011582; rev:31;)</div>
</div>
<div style="color: rgb(0, 0, 0); "><br>
</div>
<div style="color: rgb(0, 0, 0); ">Fast.log</div>
<div style="color: rgb(0, 0, 0); ">
<div>08/22/2013-08:36:38.770429 [**] [1:2011582:31] ET POLICY Vulnerable Java Version 1.6.x Detected [**] [Classification: Potentially Bad Traffic] [Priority: 2</div>
<div>] {TCP} 192.168.0.143:4803 -> 156.151.59.19:80</div>
</div>
<div style="color: rgb(0, 0, 0); "><br>
</div>
<div style="color: rgb(0, 0, 0); ">drop.log</div>
<div style="color: rgb(0, 0, 0); ">
<div>08/22/2013-08:36:38.770429: IN= OUT= SRC=192.168.0.143 DST=156.151.59.19 LEN=221 TOS=0x00 TTL=128 ID=18727 PROTO=TCP SPT=4803 DPT=80 SEQ=2569271462 ACK=1691</div>
<div>480634 WINDOW=64240 ACK PSH RES=0x00 URGP=0</div>
</div>
<div style="color: rgb(0, 0, 0); font-size: 15px; font-family: Calibri, sans-serif; ">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-size: 15px; font-family: Calibri, sans-serif; ">
<br>
</div>
</body>
</html>