Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you have been placed in read-only mode.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

Snort Issue false PSNG_UDP_FILTERED_PORTSCAN

pfSense Packages

6

7

3162

Log in to reply

M
Macom2007 last edited by

Can someone explain the reason for this snort entry :

PROTO:255 PSNG_UDP_FILTERED_PORTSCAN Attempted Information Leak 178.xxx.x.xxx empty -> 188.xx.xxx.xx empty 122:21:1 01/05-11:24:04
1 Reply Last reply
Reply Quote 0
marcelloc last edited by

If traffic port is 53 then probably it's a false positive from dns traffic.
Treinamentos de Elite: http://sys-squad.com

Help a community developer! ;D
1 Reply Last reply
Reply Quote 0
M
Macom2007 last edited by

Thanks. Prot is marked with 255, DPORT and SPORT are empty. Can be DNS, or ?
1 Reply Last reply
Reply Quote 0
H
HOD last edited by

Hi

is it secure to ignore this 122:21 alerts? I got arround 20 alerts every hour.
1 of 10 IPs that snort blocks are recommend for my network.
I'am a litte bit confused about this alert, maybe an attack or not…

greetz HOD
1 Reply Last reply
Reply Quote 0
M
Metu69salemi last edited by

@Macom2007:

Thanks. Prot is marked with 255, DPORT and SPORT are empty. Can be DNS, or ?

Certainly not dns, because destination port should be tcp/udp 53
That protocol 255 is showing to be reserved. Don't know what it is
1 Reply Last reply
Reply Quote 0
C
CS last edited by

I get this alert because of Skype software. When one of my LAN hosts has a voice/video conversation with specific people (it means specific Skype versions) I get this alert periodically during the call. ;)
1 Reply Last reply
Reply Quote 0
I
iFloris last edited by

FaceTime also generates this alert.
one layer of information
removed
1 Reply Last reply
Reply Quote 0

1 / 1