[Emerging-Sigs] FP 2406011
michael.scheidell at secnap.com
Wed Oct 20 15:02:09 EDT 2010
On 10/20/10 2:54 PM, Lay, James wrote:
> Looking at the packet, investigating the port, and packet capturing
> additional, unrelated packets (netbios-ns from 192.168.0.66 looking
> for HPE8854A), lead me to believe that this is most likely a
> default/misconfigured printer driver on a Windows machine looking for
> an HP printer. Though the rule does match the 123 network, I do not
> believe this was actually RBN traffic, so I posted it here. Hope that
The rule is designed to match traffic to a certain set of ip addresses.
your proposed fix? remove that ip address? fire the guy at your
location who misconfigured the printer driver?
No, its not a FP. the packet matched traffic to 22.214.171.124 and it
has yet to be shows that the ip address in question should be removed
Again, your local mis-configurations should not force a change or edit
in a stock rule.
Michael Scheidell, CTO
>*| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best in Email Security,2010: Network Products Guide
* King of Spam Filters, SC Magazine 2008
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Emerging-sigs