[Synapse] UDP Port Attack [TraceMagic|Events]

Home _° SiteMap _° Analyse _° Preise _° Audits _° Software _° Download _° Syn-Wiki _° Kontakt _° Impressum

^TraceMagic ^{Trace Log Events}

UDP Port Attack

TraceMagic versucht, etwaige Port-Attacken zu erkennen.

Wird ein UDP-Broadcast seitens eines Absenders mehr als n Mal wiederholt (n = gesetzter
Schwellenwert/Treshold), erscheint eine Meldung wie die folgende im Event Log:


[   2]  #     60 - [2006-02-15 10:35:35 .34171] ::  1.2.255.250     << 1.2.178.1       :: UDP: Port Attack -or- Broadcast Flooding / Ports :  1900 <-  1900 (Poss. Security Problem) (Poss. Virus Attack) (Threshold: 8 Bcst.Pkts.)    :: · :: *** ::      
[   2]  #     61 - [2006-02-15 10:35:35 .34451] ::  1.2.255.250     << 1.2.178.1       :: UDP: Port Attack -or- Broadcast Flooding / Ports :  1900 <-  1900 (Poss. Security Problem) (Poss. Virus Attack) (Threshold: 8 Bcst.Pkts.)    :: · :: *** ::      
[   2]  #     62 - [2006-02-15 10:35:35 .34590] ::  1.2.255.250     << 1.2.178.1       :: UDP: Port Attack -or- Broadcast Flooding / Ports :  1900 <-  1900 (Poss. Security Problem) (Poss. Virus Attack) (Threshold: 8 Bcst.Pkts.)    :: · :: *** ::      
[   2]  #     63 - [2006-02-15 10:35:35 .34792] ::  1.2.255.250     << 1.2.178.1       :: UDP: Port Attack -or- Broadcast Flooding / Ports :  1900 <-  1900 (Poss. Security Problem) (Poss. Virus Attack) (Threshold: 8 Bcst.Pkts.)    :: · :: *** ::      
[   2]  #     64 - [2006-02-15 10:35:35 .34995] ::  1.2.255.250     << 1.2.178.1       :: UDP: Port Attack -or- Broadcast Flooding / Ports :  1900 <-  1900 (Poss. Security Problem) (Poss. Virus Attack) (Threshold: 8 Bcst.Pkts.)    :: · :: *** ::      
[   2]  #     65 - [2006-02-15 10:35:35 .35221] ::  1.2.255.250     << 1.2.178.1       :: UDP: Port Attack -or- Broadcast Flooding / Ports :  1900 <-  1900 (Poss. Security Problem) (Poss. Virus Attack) (Threshold: 8 Bcst.Pkts.)    :: · :: *** ::      
[   2]  #     66 - [2006-02-15 10:35:35 .35425] ::  1.2.255.250     << 1.2.178.1       :: UDP: Port Attack -or- Broadcast Flooding / Ports :  1900 <-  1900 (Poss. Security Problem) (Poss. Virus Attack) (Threshold: 8 Bcst.Pkts.)    :: · :: *** ::

Hierbei handelt es sich immer zunächst um Verdachtsfälle, die vom Bearbeiter verifiziert werden müssen.

Erzeugt am (Datum/Uhrzeit): 2012-05-15 / 00:28:45 ... via SYNcreator


	"Auf den ersten Blick sehen, was ist."
"Sie zeichnen auf, wir werten aus"