Guest uk girl Posted October 17, 2009 Posted October 17, 2009 (edited) hican somebody help me Analysis these codes ?!!for TCP\IP((report discussing and describing the following dump of network traffic.))08/16-15:27:17.820587 193.63.129.192:1843 -> 193.63.129.187:139TCP TTL:128 TOS:0x0 ID:48195 IpLen:20 DgmLen:44 DF******S* Seq: 0xF1908361 Ack: 0x0 Win: 0x2000 TcpLen: 24TCP Options (1) => MSS: 1460 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:17.820656 193.63.129.187:139 -> 193.63.129.192:1843TCP TTL:128 TOS:0x0 ID:2676 IpLen:20 DgmLen:44 DF***A**S* Seq: 0x7CFB7BBA Ack: 0xF1908362 Win: 0x2238 TcpLen: 24TCP Options (1) => MSS: 1460 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:17.820785 193.63.129.192:1843 -> 193.63.129.187:139TCP TTL:128 TOS:0x0 ID:48451 IpLen:20 DgmLen:40 DF***A**** Seq: 0xF1908362 Ack: 0x7CFB7BBB Win: 0x2238 TcpLen: 20=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:17.820801 193.63.129.192:1843 -> 193.63.129.187:139TCP TTL:128 TOS:0x0 ID:48707 IpLen:20 DgmLen:112 DF***AP*** Seq: 0xF1908362 Ack: 0x7CFB7BBB Win: 0x2238 TcpLen: 2081 00 00 44 20 45 4B 44 45 43 4E 45 4A 46 45 46 ...D EKDECNEJFEF43 45 4D 43 4E 44 42 44 45 43 41 43 41 43 41 43 CEMCNDBDECACACAC41 43 41 43 41 00 20 45 4B 44 45 43 4E 45 4A 46 ACACA. EKDECNEJF45 46 43 45 4D 43 4E 44 42 44 4A 43 41 43 41 43 EFCEMCNDBDJCACAC41 43 41 43 41 41 41 00 ACACAAA.=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:17.820875 193.63.129.187:139 -> 193.63.129.192:1843TCP TTL:128 TOS:0x0 ID:2932 IpLen:20 DgmLen:44 DF***AP*** Seq: 0x7CFB7BBB Ack: 0xF19083AA Win: 0x21F0 TcpLen: 2082 00 00 00 ....=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:17.916990 193.63.129.192:1843 -> 193.63.129.187:139TCP TTL:128 TOS:0x0 ID:48963 IpLen:20 DgmLen:214 DF***AP*** Seq: 0xF19083AA Ack: 0x7CFB7BBF Win: 0x2234 TcpLen: 2000 00 00 AA FF 53 4D 42 72 00 00 00 00 18 03 00 .....SMBr.......00 00 00 00 00 00 00 00 00 00 00 00 00 00 FE CA ................00 00 00 00 00 87 00 02 50 43 20 4E 45 54 57 4F ........PC NETWO52 4B 20 50 52 4F 47 52 41 4D 20 31 2E 30 00 02 RK PROGRAM 1.0..58 45 4E 49 58 20 43 4F 52 45 00 02 4D 49 43 52 XENIX CORE..MICR4F 53 4F 46 54 20 4E 45 54 57 4F 52 4B 53 20 31 OSOFT NETWORKS 12E 30 33 00 02 4C 41 4E 4D 41 4E 31 2E 30 00 02 .03..LANMAN1.0..57 69 6E 64 6F 77 73 20 66 6F 72 20 57 6F 72 6B Windows for Work67 72 6F 75 70 73 20 33 2E 31 61 00 02 4C 4D 31 groups 3.1a..LM12E 32 58 30 30 32 00 02 4C 41 4E 4D 41 4E 32 2E .2X002..LANMAN2.31 00 02 4E 54 20 4C 4D 20 30 2E 31 32 00 1..NT LM 0.12.=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:17.917098 193.63.129.187:139 -> 193.63.129.192:1843TCP TTL:128 TOS:0x0 ID:3188 IpLen:20 DgmLen:147 DF***AP*** Seq: 0x7CFB7BBF Ack: 0xF1908458 Win: 0x2142 TcpLen: 2000 00 00 67 FF 53 4D 42 72 00 00 00 00 98 03 00 ...g.SMBr.......00 00 00 00 00 00 00 00 00 00 00 00 00 00 FE CA ................00 00 00 00 11 07 00 03 32 00 01 00 04 11 00 00 ........2.......00 00 01 00 00 00 00 00 FD 43 00 00 70 E8 2D 06 .........C..p.-.31 45 C2 01 C4 FF 08 22 00 10 3F 5E D8 E2 24 3A 1E....."..?^..$:26 53 00 4F 00 43 00 5F 00 53 00 45 00 43 00 55 &S.O.C._.S.E.C.U00 52 00 49 00 54 00 59 00 00 00 .R.I.T.Y...=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:18.015822 193.63.129.192:1843 -> 193.63.129.187:139TCP TTL:128 TOS:0x0 ID:49219 IpLen:20 DgmLen:228 DF***AP*** Seq: 0xF1908458 Ack: 0x7CFB7C2A Win: 0x21C9 TcpLen: 2000 00 00 B8 FF 53 4D 42 73 00 00 00 00 18 03 80 .....SMBs.......00 00 C6 87 BA 80 0C 5F BE 6A 00 00 00 00 FE CA ......._.j......00 00 00 00 0D 75 00 84 00 04 11 32 00 00 00 00 .....u.....2....00 00 00 01 00 00 00 00 00 00 00 D4 00 00 00 47 ...............G00 00 00 00 00 00 57 00 69 00 6E 00 64 00 6F 00 ......W.i.n.d.o.77 00 73 00 20 00 4E 00 54 00 20 00 31 00 33 00 w.s. .N.T. .1.3.38 00 31 00 00 00 00 00 57 00 69 00 6E 00 64 00 8.1.....W.i.n.d.6F 00 77 00 73 00 20 00 4E 00 54 00 20 00 34 00 o.w.s. .N.T. .4.2E 00 30 00 00 00 00 00 04 FF 00 00 00 00 00 01 ..0.............00 29 00 00 5C 00 5C 00 4A 00 34 00 2D 00 49 00 .)..\.\.J.4.-.I.54 00 52 00 4C 00 2D 00 31 00 34 00 5C 00 49 00 T.R.L.-.1.4.\.I.50 00 43 00 24 00 00 00 49 50 43 00 P.C.$...IPC.=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:18.016035 193.63.129.187:139 -> 193.63.129.192:1843TCP TTL:128 TOS:0x0 ID:3444 IpLen:20 DgmLen:196 DF***AP*** Seq: 0x7CFB7C2A Ack: 0xF1908514 Win: 0x2086 TcpLen: 2000 00 00 98 FF 53 4D 42 73 00 00 00 00 98 03 80 .....SMBs.......00 00 C6 87 BA 80 0C 5F BE 6A 00 00 01 08 FE CA ......._.j......01 08 00 00 03 75 00 88 00 00 00 5F 00 00 57 00 .....u....._..W.69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 4E 00 i.n.d.o.w.s. .N.54 00 20 00 34 00 2E 00 30 00 00 00 4E 00 54 00 T. .4...0...N.T.20 00 4C 00 41 00 4E 00 20 00 4D 00 61 00 6E 00 .L.A.N. .M.a.n.61 00 67 00 65 00 72 00 20 00 34 00 2E 00 30 00 a.g.e.r. .4...0.00 00 53 00 4F 00 43 00 5F 00 53 00 45 00 43 00 ..S.O.C._.S.E.C.55 00 52 00 49 00 54 00 59 00 00 00 03 FF 00 98 U.R.I.T.Y.......00 01 00 07 00 49 50 43 00 00 00 00 .....IPC....=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:18.113012 193.63.129.192:1843 -> 193.63.129.187:139TCP TTL:128 TOS:0x0 ID:49475 IpLen:20 DgmLen:162 DF***AP*** Seq: 0xF1908514 Ack: 0x7CFB7CC6 Win: 0x212D TcpLen: 2000 00 00 76 FF 53 4D 42 25 00 00 00 00 18 03 80 ...v.SMB%.......A8 80 00 00 00 00 00 00 00 00 00 00 01 08 20 E0 .............. .01 08 40 00 0E 1A 00 00 00 08 00 68 10 00 00 00 ..@........h....00 88 13 00 00 00 00 1A 00 5C 00 00 00 00 00 00 .........\......00 37 00 00 5C 00 50 00 49 00 50 00 45 00 5C 00 .7..\.P.I.P.E.\.4C 00 41 00 4E 00 4D 00 41 00 4E 00 00 00 00 00 L.A.N.M.A.N.....68 00 57 72 4C 65 68 44 4F 00 42 31 36 42 42 44 h.WrLehDO.B16BBD7A 00 01 00 68 10 FF FF FF FF z...h.....=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+08/16-15:27:18.113749 193.63.129.187:139 -> 193.63.129.192:1843TCP TTL:128 TOS:0x0 ID:3700 IpLen:20 DgmLen:216 DF***AP*** Seq: 0x7CFB7CC6 Ack: 0xF190858E Win: 0x200C TcpLen: 2000 00 00 AC FF 53 4D 42 25 00 00 00 00 98 03 80 .....SMB%.......A8 80 00 00 00 00 00 00 00 00 00 00 01 08 20 E0 .............. .01 08 40 00 0A 08 00 6C 00 00 00 08 00 38 00 00 ..@....l.....8..00 6C 00 40 00 00 00 00 00 75 00 00 00 00 FC 0F .l.@.....u......04 00 04 00 4A 34 2D 49 54 52 4C 2D 31 34 00 00 ....J4-ITRL-14..00 00 00 00 04 00 0B 10 04 00 67 10 00 00 4A 34 ..........g...J42D 49 54 52 4C 2D 31 35 00 00 00 00 00 00 04 00 -ITRL-15........03 10 01 00 66 10 00 00 4A 34 2D 49 54 52 4C 2D ....f...J4-ITRL-31 38 00 00 00 00 00 00 04 00 03 10 01 00 65 10 18............e.00 00 4A 34 2D 49 54 52 4C 2D 31 39 00 00 00 00 ..J4-ITRL-19....00 00 04 00 03 10 03 00 64 10 00 00 00 00 00 00 ........d....... Edited October 17, 2009 by dencorso Needless big leter-size returned to normal size.
CoffeeFiend Posted October 17, 2009 Posted October 17, 2009 No need to double post, much less using two user accounts (one will be gone shortly, so pick one!)Either ways, it looks like you didn't do your homework (port 139 traffic should be a dead giveaway to anyone -- and there are many other simple clues) and somehow expect us to, without really giving us any infos (and thinking we wouldn't notice it's you again, heh). That makes me feel too lazy to even bother with SNORT's ugly and inconvenient ascii log output. This may sound harsh, but if you can't figure out the very basics from this then maybe SNORT is not for you... IDS and other network related tools kind of require you to have some basic knowledge about networking and protocols first.Closed.
cluberti Posted October 20, 2009 Posted October 20, 2009 Both accounts banned (other post) - violation of homework rules and opening multiple accounts to do so. Come back when you've grown up a bit.
Recommended Posts