[Bro] Weird stuff in weird.log?
Kim Halavakoski
kim at blackcatsec.net
Sat Apr 20 03:52:24 PDT 2013
Hi,
testing out bro and here is my next question to the bro-list.
I am seeing some weird stuff in weird.log(yeah! doh!).I am getting alot
of stuff like nappropriate_FIN, data_before_established,
possible_split_routing, active_connection_reuse etc.
Where can I control / diasable these weird-messages and control what
gets logged? I suspect that it is due to the fact that I am spanning
multiple VLANs that Bro sees, with traffic both before and after
loabalancers and NATs etc. so it kind-of sees the whole chain of packets
from outside the firewall, before / after loadbalancer behind firewall
and finally the traffic behind the loadbalancers/firewalls...would that
in some way explain the weird.log stuff shown here?
1366445558.221865 sMz3SRMvJ1f <UBFUCSATED-SRCIP> 57597
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445558.778349 28ucePIK0f5 <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 47584 data_before_established - F bro
1366445558.803882 C1cexKcJdhd <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 34297 data_before_established - F bro
1366445558.823156 C1cexKcJdhd <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 34297 inappropriate_FIN - F bro
1366445559.364974 C2jakgfKyh6 <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 34300 data_before_established - F bro
1366445559.368926 M4MZKG1MEtk <UBFUCSATED-SRCIP> 41978
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445559.368936 M4MZKG1MEtk <UBFUCSATED-SRCIP> 41978
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445559.369958 II9kgjUU29i <UBFUCSATED-SRCIP> 33842
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445559.370258 II9kgjUU29i <UBFUCSATED-SRCIP> 33842
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445559.458949 C2jakgfKyh6 <UBFUCSATED-SRCIP> 389
<UBFUCSATED-DSTIP> 34300 inappropriate_FIN - F bro
1366445559.590081 xzP6usa0oXd <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 63028 inappropriate_FIN - F bro
1366445559.590095 5XYkXUNzYFd <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 47501 inappropriate_FIN - F bro
1366445559.775448 6wzuYevBpef <UBFUCSATED-SRCIP> 37270
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445559.775824 6wzuYevBpef <UBFUCSATED-SRCIP> 37270
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445559.779481 6wzuYevBpef <UBFUCSATED-SRCIP> 37270
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445560.873320 NM2tVOQW5Nb <UBFUCSATED-SRCIP> 60618
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445560.874857 P5qPMPaCUuf <UBFUCSATED-SRCIP> 60618
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445560.875449 P5qPMPaCUuf <UBFUCSATED-SRCIP> 60618
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445561.235377 n4cK9P7xS14 <UBFUCSATED-SRCIP> 47275
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445561.235455 n4cK9P7xS14 <UBFUCSATED-SRCIP> 47275
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445561.238828 n4cK9P7xS14 <UBFUCSATED-SRCIP> 47275
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445562.716152 b7hwy5hPMx3 <UBFUCSATED-SRCIP> 34664
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445562.716642 b7hwy5hPMx3 <UBFUCSATED-SRCIP> 34664
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445562.720299 b7hwy5hPMx3 <UBFUCSATED-SRCIP> 34664
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445563.029829 3JCdOtzkBL1 <UBFUCSATED-SRCIP> 1523
<UBFUCSATED-DSTIP> 35631 data_before_established - F bro
1366445563.030430 3JCdOtzkBL1 <UBFUCSATED-SRCIP> 1523
<UBFUCSATED-DSTIP> 35631 active_connection_reuse - F bro
1366445563.039064 PuQti8prAgc <UBFUCSATED-SRCIP> 35631
<UBFUCSATED-DSTIP> 1523 data_after_reset - F bro
1366445563.244717 yUB4KmfF8hi <UBFUCSATED-SRCIP> 57618
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445563.245336 yUB4KmfF8hi <UBFUCSATED-SRCIP> 57618
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445563.250505 yUB4KmfF8hi <UBFUCSATED-SRCIP> 57618
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445563.698203 UupX3wx5GT9 <UBFUCSATED-SRCIP> 52198
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445564.737450 AnRairldCP3 <UBFUCSATED-SRCIP> 37289
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445564.737835 AnRairldCP3 <UBFUCSATED-SRCIP> 37289
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445564.742235 AnRairldCP3 <UBFUCSATED-SRCIP> 37289
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445565.118886 ITn36vbahlj <UBFUCSATED-SRCIP> 52576
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445565.119184 ITn36vbahlj <UBFUCSATED-SRCIP> 52576
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445565.148984 shxX8UNt1a3 <UBFUCSATED-SRCIP> 59902
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445565.149235 shxX8UNt1a3 <UBFUCSATED-SRCIP> 59902
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445565.885159 Dj3WAdR8v5b <UBFUCSATED-SRCIP> 60728
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445565.885595 rDy60hYCOdg <UBFUCSATED-SRCIP> 60728
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445565.886074 rDy60hYCOdg <UBFUCSATED-SRCIP> 60728
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445566.158385 5B8TeJKxXi3 <UBFUCSATED-SRCIP> 47294
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445566.158716 5B8TeJKxXi3 <UBFUCSATED-SRCIP> 47294
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445566.162550 5B8TeJKxXi3 <UBFUCSATED-SRCIP> 47294
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445567.751813 vC30wQV7K7j <UBFUCSATED-SRCIP> 34685
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445567.752999 vC30wQV7K7j <UBFUCSATED-SRCIP> 34685
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445567.757998 vC30wQV7K7j <UBFUCSATED-SRCIP> 34685
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445568.176397 RYxS3He4jqa <UBFUCSATED-SRCIP> 57637
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445568.176683 RYxS3He4jqa <UBFUCSATED-SRCIP> 57637
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445568.180986 RYxS3He4jqa <UBFUCSATED-SRCIP> 57637
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445568.779173 xatDJTfRKT5 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 32941 inappropriate_FIN - F bro
1366445568.779185 iShp45vkZB5 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 47413 inappropriate_FIN - F bro
1366445569.125537 Ibw0hED2Fob <UBFUCSATED-SRCIP> 36384
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445569.125548 uUEy466ylTf <UBFUCSATED-SRCIP> 47952
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445569.692394 eXp0EbWU2Ka <UBFUCSATED-SRCIP> 63605
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445569.692469 c12zuBPumRj <UBFUCSATED-SRCIP> 14686
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445569.763472 sA21Rb4LVz5 <UBFUCSATED-SRCIP> 37310
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445569.764000 sA21Rb4LVz5 <UBFUCSATED-SRCIP> 37310
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445569.767989 sA21Rb4LVz5 <UBFUCSATED-SRCIP> 37310
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445570.908940 GD1tiVPOnRf <UBFUCSATED-SRCIP> 60836
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445570.909404 kveiMvxFbZ2 <UBFUCSATED-SRCIP> 60836
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445570.909679 kveiMvxFbZ2 <UBFUCSATED-SRCIP> 60836
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445571.216116 GmMDwe1BuF2 <UBFUCSATED-SRCIP> 47317
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445571.216465 GmMDwe1BuF2 <UBFUCSATED-SRCIP> 47317
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445571.220271 GmMDwe1BuF2 <UBFUCSATED-SRCIP> 47317
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445572.701760 3nU4LDW2lm3 <UBFUCSATED-SRCIP> 34704
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445572.702540 3nU4LDW2lm3 <UBFUCSATED-SRCIP> 34704
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445572.710165 3nU4LDW2lm3 <UBFUCSATED-SRCIP> 34704
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445573.232767 BjdVV5GUd2b <UBFUCSATED-SRCIP> 57660
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445573.233064 BjdVV5GUd2b <UBFUCSATED-SRCIP> 57660
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445573.237140 BjdVV5GUd2b <UBFUCSATED-SRCIP> 57660
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445574.510449 r1qXhtWW1bj <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 44302 inappropriate_FIN - F bro
1366445574.510660 tObvNwyOY2g <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 35674 inappropriate_FIN - F bro
1366445574.730389 TcPdkyidOv2 <UBFUCSATED-SRCIP> 37329
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445574.730846 TcPdkyidOv2 <UBFUCSATED-SRCIP> 37329
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445574.735051 TcPdkyidOv2 <UBFUCSATED-SRCIP> 37329
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445575.913782 yDxehi4Al72 <UBFUCSATED-SRCIP> 60946
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445577.063401 otQNSnT4EN6 <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 51277 active_connection_reuse - F bro
1366445577.063728 UWRLM9DTaji <UBFUCSATED-SRCIP> 51277
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445577.743207 Mwz8weyGyR3 <UBFUCSATED-SRCIP> 34725
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445577.743652 Mwz8weyGyR3 <UBFUCSATED-SRCIP> 34725
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445577.747345 Mwz8weyGyR3 <UBFUCSATED-SRCIP> 34725
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445578.059666 iswlXZ1p4Ub <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 40619 inappropriate_FIN - F bro
1366445578.059827 E20A0zNnKr1 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 44455 inappropriate_FIN - F bro
1366445578.183760 5Y37osqnKkf <UBFUCSATED-SRCIP> 57679
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445578.184349 5Y37osqnKkf <UBFUCSATED-SRCIP> 57679
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445578.187890 5Y37osqnKkf <UBFUCSATED-SRCIP> 57679
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445578.204042 NC98VDwhyic <UBFUCSATED-SRCIP> 60005
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445578.204270 NC98VDwhyic <UBFUCSATED-SRCIP> 60005
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445578.244628 jj6AoPGcuda <UBFUCSATED-SRCIP> 1522
<UBFUCSATED-DSTIP> 28963 data_before_established - F bro
1366445578.244639 jj6AoPGcuda <UBFUCSATED-SRCIP> 1522
<UBFUCSATED-DSTIP> 28963 inappropriate_FIN - F bro
1366445578.706908 A1Zs7s7nXwk <UBFUCSATED-SRCIP> 52529
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445579.765173 o2wIRfp99bf <UBFUCSATED-SRCIP> 37350
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445579.765499 o2wIRfp99bf <UBFUCSATED-SRCIP> 37350
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445579.770880 o2wIRfp99bf <UBFUCSATED-SRCIP> 37350
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445580.926279 kbXAp4Y6A02 <UBFUCSATED-SRCIP> 32821
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445580.926714 PisVwAmRZme <UBFUCSATED-SRCIP> 32821
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445580.926772 PisVwAmRZme <UBFUCSATED-SRCIP> 32821
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445581.207573 LiB2ITRfHhd <UBFUCSATED-SRCIP> 47357
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445581.207883 LiB2ITRfHhd <UBFUCSATED-SRCIP> 47357
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445581.214265 LiB2ITRfHhd <UBFUCSATED-SRCIP> 47357
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445582.778903 L3DPgYmunWg <UBFUCSATED-SRCIP> 34746
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445582.779365 L3DPgYmunWg <UBFUCSATED-SRCIP> 34746
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445582.783030 L3DPgYmunWg <UBFUCSATED-SRCIP> 34746
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445583.224117 Kj2jZLpcHQ8 <UBFUCSATED-SRCIP> 57700
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445583.224643 Kj2jZLpcHQ8 <UBFUCSATED-SRCIP> 57700
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445583.227992 Kj2jZLpcHQ8 <UBFUCSATED-SRCIP> 57700
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445583.243559 e7hVXNWAcXd <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 59937 data_before_established - F bro
1366445583.243600 e7hVXNWAcXd <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 59937 active_connection_reuse - F bro
1366445583.243729 IQ7JRPICo5h <UBFUCSATED-SRCIP> 59937
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445583.243797 IQ7JRPICo5h <UBFUCSATED-SRCIP> 59937
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445583.701833 bCOWiFYHCD <UBFUCSATED-SRCIP> 52635
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445584.687427 JGJvoLHFEB7 <UBFUCSATED-SRCIP> 37373
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445584.687809 JGJvoLHFEB7 <UBFUCSATED-SRCIP> 37373
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445584.691962 JGJvoLHFEB7 <UBFUCSATED-SRCIP> 37373
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445586.153302 3Ob4kGkMRh1 <UBFUCSATED-SRCIP> 47376
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445586.153590 3Ob4kGkMRh1 <UBFUCSATED-SRCIP> 47376
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445586.157429 3Ob4kGkMRh1 <UBFUCSATED-SRCIP> 47376
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445587.725699 tc0YRXXhLte <UBFUCSATED-SRCIP> 34771
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445587.726034 tc0YRXXhLte <UBFUCSATED-SRCIP> 34771
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445587.731125 tc0YRXXhLte <UBFUCSATED-SRCIP> 34771
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445588.637477 Q02XJs56kOh <UBFUCSATED-SRCIP> 53571
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445588.638637 6ZMW9bImJPk <UBFUCSATED-SRCIP> 53571
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445588.638854 6ZMW9bImJPk <UBFUCSATED-SRCIP> 53571
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445588.739231 0TqgtuL9f09 <UBFUCSATED-SRCIP> 52745
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445589.240728 eGBBdQdpsa4 <UBFUCSATED-SRCIP> 51904
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445589.241435 GuQiSBjJV81 <UBFUCSATED-SRCIP> 52907
<UBFUCSATED-DSTIP> 9997 possible_split_routing - F bro
1366445589.620204 OQ9yx4BafSe <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 63043 inappropriate_FIN - F bro
1366445589.620212 mJB9omzWSJ4 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 47518 inappropriate_FIN - F bro
1366445589.669002 yP5EYio24W <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 41757 inappropriate_FIN - F bro
1366445589.669023 W7CKWaOEVy9 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 33300 inappropriate_FIN - F bro
1366445589.746727 CrufwTKL6Ge <UBFUCSATED-SRCIP> 37396
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445589.747158 CrufwTKL6Ge <UBFUCSATED-SRCIP> 37396
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445589.750101 CrufwTKL6Ge <UBFUCSATED-SRCIP> 37396
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445590.927663 DsNA8pbfsBc <UBFUCSATED-SRCIP> 33044
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445590.929037 zhl0AijYsK <UBFUCSATED-SRCIP> 33044
<UBFUCSATED-DSTIP> 22 possible_split_routing - F bro
1366445590.929271 zhl0AijYsK <UBFUCSATED-SRCIP> 33044
<UBFUCSATED-DSTIP> 22 inappropriate_FIN - F bro
1366445591.201280 1eOWlJTZgA4 <UBFUCSATED-SRCIP> 47397
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445591.201483 1eOWlJTZgA4 <UBFUCSATED-SRCIP> 47397
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445591.205162 1eOWlJTZgA4 <UBFUCSATED-SRCIP> 47397
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445592.084380 HzDFhdIAHGk <UBFUCSATED-SRCIP> 40657
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445592.084641 HzDFhdIAHGk <UBFUCSATED-SRCIP> 40657
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.131622 xOlqn2UHYBh <UBFUCSATED-SRCIP> 36773
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445592.131814 xOlqn2UHYBh <UBFUCSATED-SRCIP> 36773
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.132775 9RwZo1ZqMu7 <UBFUCSATED-SRCIP> 36776
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445592.133552 9RwZo1ZqMu7 <UBFUCSATED-SRCIP> 36776
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.134698 t5FrtDo8b99 <UBFUCSATED-SRCIP> 36777
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445592.135041 t5FrtDo8b99 <UBFUCSATED-SRCIP> 36777
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.165969 5ZAeOoyBTw4 <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 40250 active_connection_reuse - F bro
1366445592.166997 nwlzihurpM <UBFUCSATED-SRCIP> 40250
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445592.769294 HtIFXqFKxc9 <UBFUCSATED-SRCIP> 34790
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445592.769819 HtIFXqFKxc9 <UBFUCSATED-SRCIP> 34790
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445592.773547 HtIFXqFKxc9 <UBFUCSATED-SRCIP> 34790
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445593.220485 LCp8FbOMFyh <UBFUCSATED-SRCIP> 57740
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445593.220765 LCp8FbOMFyh <UBFUCSATED-SRCIP> 57740
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445593.224419 LCp8FbOMFyh <UBFUCSATED-SRCIP> 57740
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445594.687187 CuOQQ7zeFv9 <UBFUCSATED-SRCIP> 37415
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445594.687523 CuOQQ7zeFv9 <UBFUCSATED-SRCIP> 37415
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445594.691361 CuOQQ7zeFv9 <UBFUCSATED-SRCIP> 37415
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445596.150750 SBPXzXc2Ld4 <UBFUCSATED-SRCIP> 47416
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445596.151009 SBPXzXc2Ld4 <UBFUCSATED-SRCIP> 47416
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445596.154921 SBPXzXc2Ld4 <UBFUCSATED-SRCIP> 47416
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445597.184565 qEiR2l1TFRk <UBFUCSATED-SRCIP> 56920
<UBFUCSATED-DSTIP> 389 possible_split_routing - F bro
1366445597.184651 qEiR2l1TFRk <UBFUCSATED-SRCIP> 56920
<UBFUCSATED-DSTIP> 389 data_before_established - F bro
1366445597.710011 SOoWl6RKWKh <UBFUCSATED-SRCIP> 34811
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445597.710502 SOoWl6RKWKh <UBFUCSATED-SRCIP> 34811
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445597.714152 SOoWl6RKWKh <UBFUCSATED-SRCIP> 34811
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445598.056099 uggbZJSe6Y <UBFUCSATED-SRCIP> 38292
<UBFUCSATED-DSTIP> 22 active_connection_reuse - F bro
1366445598.166435 8sGmATv0hQe <UBFUCSATED-SRCIP> 57759
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445598.166768 8sGmATv0hQe <UBFUCSATED-SRCIP> 57759
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445598.171075 8sGmATv0hQe <UBFUCSATED-SRCIP> 57759
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445598.314109 Dagu32rJNve <UBFUCSATED-SRCIP> 42335
<UBFUCSATED-DSTIP> 30090 possible_split_routing - F bro
1366445598.314407 Dagu32rJNve <UBFUCSATED-SRCIP> 42335
<UBFUCSATED-DSTIP> 30090 data_before_established - F bro
1366445598.317858 pUHgaskr6q4 <UBFUCSATED-SRCIP> 43443
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445598.318003 pUHgaskr6q4 <UBFUCSATED-SRCIP> 43443
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445598.337726 h9SmXzOmYj9 <UBFUCSATED-SRCIP> 34044
<UBFUCSATED-DSTIP> 5666 possible_split_routing - F bro
1366445598.337961 h9SmXzOmYj9 <UBFUCSATED-SRCIP> 34044
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445598.342370 ze6jFUsuRrd <UBFUCSATED-SRCIP> 42337
<UBFUCSATED-DSTIP> 30090 possible_split_routing - F bro
1366445598.348767 ze6jFUsuRrd <UBFUCSATED-SRCIP> 42337
<UBFUCSATED-DSTIP> 30090 data_before_established - F bro
1366445598.420624 lW5R8mIZ1Rl <UBFUCSATED-SRCIP> 5666
<UBFUCSATED-DSTIP> 51409 active_connection_reuse - F bro
1366445598.420785 tbjrXcZo2F8 <UBFUCSATED-SRCIP> 51409
<UBFUCSATED-DSTIP> 5666 data_before_established - F bro
1366445598.833697 FbWPTvKfWE7 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 47414 inappropriate_FIN - F bro
1366445598.833866 mPmGNK0x3Y7 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 32944 inappropriate_FIN - F bro
1366445599.718553 qOMrTniwJO8 <UBFUCSATED-SRCIP> 37436
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445599.718580 qOMrTniwJO8 <UBFUCSATED-SRCIP> 37436
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445599.721075 qOMrTniwJO8 <UBFUCSATED-SRCIP> 37436
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445601.197471 A6hBUcHyYn <UBFUCSATED-SRCIP> 47438
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445601.197857 A6hBUcHyYn <UBFUCSATED-SRCIP> 47438
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445601.201627 A6hBUcHyYn <UBFUCSATED-SRCIP> 47438
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445602.737133 fMC2czM4ad5 <UBFUCSATED-SRCIP> 34830
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445602.737195 fMC2czM4ad5 <UBFUCSATED-SRCIP> 34830
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445602.739803 fMC2czM4ad5 <UBFUCSATED-SRCIP> 34830
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445603.217926 5KQYxY7FEjd <UBFUCSATED-SRCIP> 57781
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445603.218318 5KQYxY7FEjd <UBFUCSATED-SRCIP> 57781
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445603.222483 5KQYxY7FEjd <UBFUCSATED-SRCIP> 57781
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445604.158883 ND8g7Onxkol <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 35676 data_before_established - F bro
1366445604.598523 5BsmxtcRqUg <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 44304 inappropriate_FIN - F bro
1366445604.769609 mkfqXaTHoYd <UBFUCSATED-SRCIP> 37455
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445604.769945 mkfqXaTHoYd <UBFUCSATED-SRCIP> 37455
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445604.773733 mkfqXaTHoYd <UBFUCSATED-SRCIP> 37455
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445606.233186 2YpIesZO8S8 <UBFUCSATED-SRCIP> 47457
<UBFUCSATED-DSTIP> 30310 possible_split_routing - F bro
1366445606.233483 2YpIesZO8S8 <UBFUCSATED-SRCIP> 47457
<UBFUCSATED-DSTIP> 30310 data_before_established - F bro
1366445606.237583 2YpIesZO8S8 <UBFUCSATED-SRCIP> 47457
<UBFUCSATED-DSTIP> 30310 inappropriate_FIN - F bro
1366445607.696371 pEFuDb9cZb8 <UBFUCSATED-SRCIP> 34851
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445607.696856 pEFuDb9cZb8 <UBFUCSATED-SRCIP> 34851
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
1366445607.700532 pEFuDb9cZb8 <UBFUCSATED-SRCIP> 34851
<UBFUCSATED-DSTIP> 30390 inappropriate_FIN - F bro
1366445608.078190 VrW91Y7Afml <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 40622 inappropriate_FIN - F bro
1366445608.078379 T3BCgECYnt8 <UBFUCSATED-SRCIP> 9997
<UBFUCSATED-DSTIP> 44458 inappropriate_FIN - F bro
1366445608.161685 djiIIUpoL2 <UBFUCSATED-SRCIP> 57800
<UBFUCSATED-DSTIP> 30390 possible_split_routing - F bro
1366445608.162008 djiIIUpoL2 <UBFUCSATED-SRCIP> 57800
<UBFUCSATED-DSTIP> 30390 data_before_established - F bro
--
-- kimh
--------------------------------------------------------
Kim Halavakoski - Chief Everything Officer - GCIH
Black Cat Security - http://www.blackcatsec.net
email: kim at blackcatsec.net Mobile: +358 xxx xxxxxxx
PGP: 0BFA A910 9AA7 94A5 A323 53F5 4151 4CE4
--------------------------------------------------------
More information about the Bro
mailing list