Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- Technology and Support
- Security
- Security Knowledge Base
- Verbose vs. Non-Verbose IPS Alerts
Options
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
1702
Views
0
Helpful
0
Comments
Options
- Subscribe to RSS Feed
- Mark as New
- Mark as Read
- Bookmark
- Subscribe
- Printer Friendly Page
- Report Inappropriate Content
07-22-2010 08:39 AM - edited 03-08-2019 06:33 PM
Non-Verbose
evIdsAlert: eventId=1259871580872281266 severity=medium vendor=Cisco
originator:
hostId: AIP-SSM-10
appName: sensorApp
appInstanceId: 421
time: 2009/12/13 12:00:47 2009/12/13 12:00:47 UTC
signature: description=IPS60003Sig id=60000 created=20000101 type=other version=custom
subsigId: 0
sigDetails: My Sig Info
marsCategory: Info/Misc
interfaceGroup: vs0
vlan: 0
participants:
attacker:
addr: locality=OUT 192.168.1.2
port: 80
target:
addr: locality=OUT 172.18.254.185
port: 7409
os: idSource=learned relevance=relevant type=windows-nt-2k-xp
context:
fromAttacker:
000000 30 20 47 4D 54 0D 0A 45 54 61 67 3A 20 22 31 30 0 GMT..ETag: "10
000010 64 37 62 36 2D 39 65 2D 34 37 61 34 63 65 62 64 d7b6-9e-47a4cebd
000020 62 64 62 30 30 22 0D 0A 41 63 63 65 70 74 2D 52 bdb00"..Accept-R
000030 61 6E 67 65 73 3A 20 62 79 74 65 73 0D 0A 43 6F anges: bytes..Co
000040 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 31 35 ntent-Length: 15
000050 38 0D 0A 4B 65 65 70 2D 41 6C 69 76 65 3A 20 74 8..Keep-Alive: t
000060 69 6D 65 6F 75 74 3D 31 35 2C 20 6D 61 78 3D 39 imeout=15, max=9
000070 36 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 6..Connection: K
000080 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F 6E 74 65 eep-Alive..Conte
000090 6E 74 2D 54 79 70 65 3A 20 74 65 78 74 2F 68 74 nt-Type: text/ht
0000A0 6D 6C 0D 0A 0D 0A 3C 68 74 6D 6C 3E 0A 3C 68 65 ml....<html>.<he
0000B0 61 64 3E 0A 3C 6D 65 74 61 20 68 74 74 70 2D 65 ad>.<meta http-e
0000C0 71 75 69 76 3D 22 72 65 66 72 65 73 68 22 20 63 quiv="refresh" c
0000D0 6F 6E 74 65 6E 74 3D 22 33 30 22 3E 0A 3C 2F 68 ontent="30">.</h
0000E0 65 61 64 3E 0A 3C 62 6F 64 79 3E 0A 3C 61 20 6E ead>.<body>.<a n
0000F0 61 6D 65 3D 22 49 50 53 36 30 30 30 33 53 69 67 ame="IPS60003Sig
fromTarget:
000000 6D 6C 2C 61 70 70 6C 69 63 61 74 69 6F 6E 2F 78 ml,application/x
000010 68 74 6D 6C 2B 78 6D 6C 2C 61 70 70 6C 69 63 61 html+xml,applica
000020 74 69 6F 6E 2F 78 6D 6C 3B 71 3D 30 2E 39 2C 2A tion/xml;q=0.9,*
000030 2F 2A 3B 71 3D 30 2E 38 0D 0A 41 63 63 65 70 74 /*;q=0.8..Accept
000040 2D 4C 61 6E 67 75 61 67 65 3A 20 65 6E 2D 75 73 -Language: en-us
000050 2C 65 6E 3B 71 3D 30 2E 35 0D 0A 41 63 63 65 70 ,en;q=0.5..Accep
000060 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 t-Encoding: gzip
000070 2C 64 65 66 6C 61 74 65 0D 0A 41 63 63 65 70 74 ,deflate..Accept
000080 2D 43 68 61 72 73 65 74 3A 20 49 53 4F 2D 38 38 -Charset: ISO-88
000090 35 39 2D 31 2C 75 74 66 2D 38 3B 71 3D 30 2E 37 59-1,utf-8;q=0.7
0000A0 2C 2A 3B 71 3D 30 2E 37 0D 0A 4B 65 65 70 2D 41 ,*;q=0.7..Keep-A
0000B0 6C 69 76 65 3A 20 33 30 30 0D 0A 43 6F 6E 6E 65 live: 300..Conne
0000C0 63 74 69 6F 6E 3A 20 6B 65 65 70 2D 61 6C 69 76 ction: keep-aliv
0000D0 65 0D 0A 50 72 61 67 6D 61 3A 20 6E 6F 2D 63 61 e..Pragma: no-ca
0000E0 63 68 65 0D 0A 43 61 63 68 65 2D 43 6F 6E 74 72 che..Cache-Contr
0000F0 6F 6C 3A 20 6E 6F 2D 63 61 63 68 65 0D 0A 0D 0A ol: no-cache....
alertDetails: InterfaceAttributes: context="single_vf" physical="Unknown" backplane="GigabitEthernet0/1" ;
riskRatingValue: attackRelevanceRating=relevant targetValueRating=medium 66
threatRatingValue: 66
interface: backplane=GigabitEthernet0/1 context=single_vf physical=Unknown GigabitEthernet0/1
protocol: tcp
Verbose
evIdsAlert: eventId=1259871580872281279 severity=medium vendor=Cisco
originator:
hostId: AIP-SSM-10
appName: sensorApp
appInstanceId: 421
time: 2009/12/13 12:03:33 2009/12/13 12:03:33 UTC
signature: description=IPS60003Sig id=60000 created=20000101 type=other version=custom
subsigId: 0
sigDetails: My Sig Info
marsCategory: Info/Misc
interfaceGroup: vs0
vlan: 0
participants:
attacker:
addr: locality=OUT 192.168.1.2
port: 80
target:
addr: locality=OUT 172.18.254.185
port: 57544
os: idSource=learned relevance=relevant type=windows-nt-2k-xp
context:
fromAttacker:
000000 20 47 4D 54 0D 0A 45 54 61 67 3A 20 22 31 30 64 GMT..ETag: "10d
000010 37 62 36 2D 39 65 2D 34 37 61 34 63 65 62 64 62 7b6-9e-47a4cebdb
000020 64 62 30 30 22 0D 0A 41 63 63 65 70 74 2D 52 61 db00"..Accept-Ra
000030 6E 67 65 73 3A 20 62 79 74 65 73 0D 0A 43 6F 6E nges: bytes..Con
000040 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 31 35 38 tent-Length: 158
000050 0D 0A 4B 65 65 70 2D 41 6C 69 76 65 3A 20 74 69 ..Keep-Alive: ti
000060 6D 65 6F 75 74 3D 31 35 2C 20 6D 61 78 3D 31 30 meout=15, max=10
000070 30 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B 0..Connection: K
000080 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F 6E 74 65 eep-Alive..Conte
000090 6E 74 2D 54 79 70 65 3A 20 74 65 78 74 2F 68 74 nt-Type: text/ht
0000A0 6D 6C 0D 0A 0D 0A 3C 68 74 6D 6C 3E 0A 3C 68 65 ml....<html>.<he
0000B0 61 64 3E 0A 3C 6D 65 74 61 20 68 74 74 70 2D 65 ad>.<meta http-e
0000C0 71 75 69 76 3D 22 72 65 66 72 65 73 68 22 20 63 quiv="refresh" c
0000D0 6F 6E 74 65 6E 74 3D 22 33 30 22 3E 0A 3C 2F 68 ontent="30">.</h
0000E0 65 61 64 3E 0A 3C 62 6F 64 79 3E 0A 3C 61 20 6E ead>.<body>.<a n
0000F0 61 6D 65 3D 22 49 50 53 36 30 30 30 33 53 69 67 ame="IPS60003Sig
fromTarget:
000000 6D 6C 2C 61 70 70 6C 69 63 61 74 69 6F 6E 2F 78 ml,application/x
000010 68 74 6D 6C 2B 78 6D 6C 2C 61 70 70 6C 69 63 61 html+xml,applica
000020 74 69 6F 6E 2F 78 6D 6C 3B 71 3D 30 2E 39 2C 2A tion/xml;q=0.9,*
000030 2F 2A 3B 71 3D 30 2E 38 0D 0A 41 63 63 65 70 74 /*;q=0.8..Accept
000040 2D 4C 61 6E 67 75 61 67 65 3A 20 65 6E 2D 75 73 -Language: en-us
000050 2C 65 6E 3B 71 3D 30 2E 35 0D 0A 41 63 63 65 70 ,en;q=0.5..Accep
000060 74 2D 45 6E 63 6F 64 69 6E 67 3A 20 67 7A 69 70 t-Encoding: gzip
000070 2C 64 65 66 6C 61 74 65 0D 0A 41 63 63 65 70 74 ,deflate..Accept
000080 2D 43 68 61 72 73 65 74 3A 20 49 53 4F 2D 38 38 -Charset: ISO-88
000090 35 39 2D 31 2C 75 74 66 2D 38 3B 71 3D 30 2E 37 59-1,utf-8;q=0.7
0000A0 2C 2A 3B 71 3D 30 2E 37 0D 0A 4B 65 65 70 2D 41 ,*;q=0.7..Keep-A
0000B0 6C 69 76 65 3A 20 33 30 30 0D 0A 43 6F 6E 6E 65 live: 300..Conne
0000C0 63 74 69 6F 6E 3A 20 6B 65 65 70 2D 61 6C 69 76 ction: keep-aliv
0000D0 65 0D 0A 50 72 61 67 6D 61 3A 20 6E 6F 2D 63 61 e..Pragma: no-ca
0000E0 63 68 65 0D 0A 43 61 63 68 65 2D 43 6F 6E 74 72 che..Cache-Contr
0000F0 6F 6C 3A 20 6E 6F 2D 63 61 63 68 65 0D 0A 0D 0A ol: no-cache....
alertDetails: InterfaceAttributes: context="single_vf" physical="Unknown" backplane="GigabitEthernet0/1" ;
triggerPacket:
000000 00 13 C4 80 73 DF 00 03 47 93 4A 51 08 00 45 00 ....s...G.JQ..E.
000010 01 E9 9B 59 40 00 40 06 81 B9 0E 26 63 0A AC 12 ...Y@.@....&c...
000020 FE B9 00 50 E0 C8 2D B7 32 00 44 4F 6F D5 50 18 ...P..-.2.DOo.P.
000030 19 20 08 06 00 00 48 54 54 50 2F 31 2E 31 20 32 . ....HTTP/1.1 2
000040 30 30 20 4F 4B 0D 0A 44 61 74 65 3A 20 53 75 6E 00 OK..Date: Sun
000050 2C 20 31 33 20 44 65 63 20 32 30 30 39 20 30 37 , 13 Dec 2009 07
000060 3A 31 34 3A 31 39 20 47 4D 54 0D 0A 53 65 72 76 :14:19 GMT..Serv
000070 65 72 3A 20 41 70 61 63 68 65 2F 32 2E 32 2E 39 er: Apache/2.2.9
000080 20 28 55 62 75 6E 74 75 29 0D 0A 4C 61 73 74 2D (Ubuntu)..Last-
000090 4D 6F 64 69 66 69 65 64 3A 20 57 65 64 2C 20 30 Modified: Wed, 0
0000A0 39 20 44 65 63 20 32 30 30 39 20 31 34 3A 35 38 9 Dec 2009 14:58
0000B0 3A 32 30 20 47 4D 54 0D 0A 45 54 61 67 3A 20 22 :20 GMT..ETag: "
0000C0 31 30 64 37 62 36 2D 39 65 2D 34 37 61 34 63 65 10d7b6-9e-47a4ce
0000D0 62 64 62 64 62 30 30 22 0D 0A 41 63 63 65 70 74 bdbdb00"..Accept
0000E0 2D 52 61 6E 67 65 73 3A 20 62 79 74 65 73 0D 0A -Ranges: bytes..
0000F0 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 Content-Length:
000100 31 35 38 0D 0A 4B 65 65 70 2D 41 6C 69 76 65 3A 158..Keep-Alive:
000110 20 74 69 6D 65 6F 75 74 3D 31 35 2C 20 6D 61 78 timeout=15, max
000120 3D 31 30 30 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E =100..Connection
000130 3A 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 43 6F : Keep-Alive..Co
000140 6E 74 65 6E 74 2D 54 79 70 65 3A 20 74 65 78 74 ntent-Type: text
000150 2F 68 74 6D 6C 0D 0A 0D 0A 3C 68 74 6D 6C 3E 0A /html....<html>.
000160 3C 68 65 61 64 3E 0A 3C 6D 65 74 61 20 68 74 74 <head>.<meta htt
000170 70 2D 65 71 75 69 76 3D 22 72 65 66 72 65 73 68 p-equiv="refresh
000180 22 20 63 6F 6E 74 65 6E 74 3D 22 33 30 22 3E 0A " content="30">.
000190 3C 2F 68 65 61 64 3E 0A 3C 62 6F 64 79 3E 0A 3C </head>.<body>.<
0001A0 61 20 6E 61 6D 65 3D 22 49 50 53 36 30 30 30 33 a name="IPS60003
0001B0 53 69 67 22 20 3E 3C 2F 61 3E 0A 41 6C 6C 59 6F Sig" >.AllYo
0001C0 75 72 42 61 73 65 41 72 65 42 65 6C 6F 6E 67 54 urBaseAreBelongT
0001D0 6F 55 73 0A 3C 68 31 3E 49 74 20 77 6F 72 6B 73 oUs.<h1>It works
0001E0 21 3C 2F 68 31 3E 0A 3C 2F 62 6F 64 79 3E 0A 3C !</h1>.</body>.<
0001F0 2F 68 74 6D 6C 3E 0A /html>.
riskRatingValue: attackRelevanceRating=relevant targetValueRating=medium 66
threatRatingValue: 66
interface: backplane=GigabitEthernet0/1 context=single_vf physical=Unknown GigabitEthernet0/1
protocol: tcp
Labels:
Getting Started
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:
Customers Also Viewed These Support Documents