Hi

Sorry can't help you with this; but I am about to set up a firewall box with Smoothwall over Xmas - New Year break; any warnings, suggestions etc?

Merry Xmas to all!

Wayne

> "Michael Hunt" <michael.j.hunt@usa.net> <plug@plug.linux.org.au>Date: Mon, 24 Dec 2001 23:15:58 +0800
> [plug] Smoothwall IDS/snort questionReply-To: plug@plug.linux.org.au
>
>Hi ya Pluggers,
>
>Anyone care to interpret the IDS logs from Smoothwall. For a period of about
>2 seconds I got the following about 4 times.
>
>SmoothWall IDS snort log
>Date: 24 December
>
>Date: 12/24 02:25:42
>Name: Virus - Possible scr Worm
>Priority: n/a
>Type: n/a
>IP Info: 165.212.8.34:110 -> 203.34.16.182:61111
>Refs:
>
>The first IP address happens to be a POP server that I have an account with
>(not under my direct admin). The second address is my dynamic IP that I had
>at the time of the connection. It seems to me fro some strange reason that
>the pop server initiated a connection to my firewall and for some reason
>smoothwalls IDS (snort I believe) has logged it as an Intrusion.
>
>Can anyone cast any light on this ???
>
>Michael Hunt




------------------------------------------------------------
FREE EMAIL for all from AUSI at http://ausi.com    Access world wide.

