[prev in list] [next in list] [prev in thread] [next in thread]
List: snort-users
Subject: Re: [Snort-users] MISC UPnp malformed advertisement
From: Dorian ROSSE <dorianbrice () hotmail ! fr>
Date: 2018-09-18 16:09:42
Message-ID: AM4PR08MB1124D367E673C642EA46C2D3DA1D0 () AM4PR08MB1124 ! eurprd08 ! prod ! outlook ! com
[Download RAW message or body]
[Attachment #2 (text/plain)]
Read this URL I advice 😉
http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node4.html
This URL explain how to use the sniffer mode 😃
Regards.
Dorian ROSSE.
________________________________
De : Snort-users <snort-users-bounces@lists.snort.org> de la part de ThyNgon Tran via \
Snort-users <snort-users@lists.snort.org> Envoyé : Tuesday, September 18, 2018 \
5:29:03 PM À : snort-users@lists.snort.org
Objet : [Snort-users] MISC UPnp malformed advertisement
Hello there,
I am new to IDS in general. Just installed snort on my home network and found out \
tons of UPnP broadcasting traffics from an EPSON Artisan 837 printer and a Verizon \
top box. About 5 broadcast messages from each device showed like every sec. Are these \
normal traffics? I think there is a malware on the printer. I am about to upgrade \
the printer firmware but not sure what to do with the verizon topbox.
Has anyone run into this before? Thanks!
--
ThyNgon Tran
https://vbc.cyburi.com
faster, higher, and stronger
[Attachment #3 (text/html)]
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style>
<div class="WordSection1">
<p class="MsoNormal">Read this URL I advice <span style="font-family:"Segoe \
UI Emoji",sans-serif">😉</span><br> <br>
<a href="http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node4.html">http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node4.html</a><br>
<br>
This URL explain how to use the sniffer mode <span \
style="font-family:"Segoe UI Emoji",sans-serif">😃</span><br> <br>
Regards.<br>
<br>
<br>
Dorian ROSSE.</p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" \
style="font-size:11pt" color="#000000"><b>De :</b> Snort-users \
<snort-users-bounces@lists.snort.org> de la part de ThyNgon Tran via \
Snort-users <snort-users@lists.snort.org><br> <b>Envoyé :</b> Tuesday, \
September 18, 2018 5:29:03 PM<br> <b>À :</b> snort-users@lists.snort.org<br>
<b>Objet :</b> [Snort-users] MISC UPnp malformed advertisement</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div><font color="#1d2129" face="Helvetica, Arial, sans-serif"><span \
style="font-size:14px">Hello there,</span></font></div> <div><font color="#1d2129" \
face="Helvetica, Arial, sans-serif"><span style="font-size:14px"><br> \
</span></font></div> <div><span \
style="color:rgb(29,33,41);font-family:Helvetica,Arial,sans-serif;font-size:14px">I \
am new to IDS in general. Just installed snort on my home network and found out \
tons of UPnP broadcasting traffics from an EPSON Artisan 837 printer and a Verizon \
top box. About 5 broadcast messages from each device showed like every sec. Are these \
normal traffics? I think there is a malware on the printer. </span><span \
style="color:rgb(29,33,41);font-family:Helvetica,Arial,sans-serif;font-size:14px">I \
am about to upgrade the printer firmware but not sure what to do with the verizon \
topbox.</span></div> <div><span \
style="color:rgb(29,33,41);font-family:Helvetica,Arial,sans-serif;font-size:14px"><br>
</span></div>
<div><span style="color:rgb(29,33,41);font-family:Helvetica,Arial,sans-serif;font-size:14px">Has \
anyone run into this before?</span> Thanks!</div> <div><br>
</div>
<div><br>
</div>
-- <br>
<div dir="ltr" class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">ThyNgon Tran<br>
<a href="https://vbc.cyburi.com" target="_blank">https://vbc.cyburi.com</a></div>
<div dir="ltr"><span style="font-size:small">faster, higher, and stronger</span><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>
_______________________________________________
Snort-users mailing list
Snort-users@lists.snort.org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users
To unsubscribe, send an email to:
snort-users-leave@lists.snort.org
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
--===============4750447744695546393==--
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic