------------------------------------------------------------------------------ #(1 - 335309) [2010-05-19 13:40:46] [local/1000002] [snort/1:1000002] LOCAL Inbound Traffic to Unused UDP Ports -- BLOCKING SOURCE IPv4: 131.107.0.116 -> 91.121.85.146 hlen=5 TOS=0 dlen=556 ID=23494 flags=0 offset=0 TTL=46 chksum=64016 UDP: port=500 -> dport: 500 len=536 Payload: length = 528 000 : FC 6B 1D 52 93 95 23 35 00 00 00 00 00 00 00 00 .k.R..#5........ 010 : 01 10 02 00 00 00 00 00 00 00 02 10 0D 00 01 64 ...............d 020 : 00 00 00 01 00 00 00 01 00 00 01 58 01 01 00 08 ...........X.... 030 : 03 00 00 30 01 01 00 00 80 01 00 05 80 02 00 02 ...0............ 040 : 80 04 00 02 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 050 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 060 : 03 00 00 30 02 01 00 00 80 01 00 05 80 02 00 01 ...0............ 070 : 80 04 00 02 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 080 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 090 : 03 00 00 30 03 01 00 00 80 01 00 01 80 02 00 02 ...0............ 0a0 : 80 04 00 01 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 0b0 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 0c0 : 03 00 00 30 04 01 00 00 80 01 00 01 80 02 00 01 ...0............ 0d0 : 80 04 00 01 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 0e0 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 0f0 : 03 00 00 24 05 01 00 00 80 01 00 05 80 02 00 02 ...$............ 100 : 80 04 00 02 80 03 00 03 80 0B 00 01 00 0C 00 04 ................ 110 : 00 00 1C 20 03 00 00 24 06 01 00 00 80 01 00 05 ... ...$........ 120 : 80 02 00 01 80 04 00 02 80 03 00 03 80 0B 00 01 ................ 130 : 00 0C 00 04 00 00 1C 20 03 00 00 24 07 01 00 00 ....... ...$.... 140 : 80 01 00 01 80 02 00 02 80 04 00 01 80 03 00 03 ................ 150 : 80 0B 00 01 00 0C 00 04 00 00 1C 20 00 00 00 24 ........... ...$ 160 : 08 01 00 00 80 01 00 01 80 02 00 01 80 04 00 01 ................ 170 : 80 03 00 03 80 0B 00 01 00 0C 00 04 00 00 1C 20 ............... 180 : 0D 00 00 18 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF .....+Qi...}|... 190 : B5 87 E4 61 00 00 00 08 0D 00 00 14 4A 13 1C 81 ...a........J... 1a0 : 07 03 58 45 5C 57 28 F2 0E 95 45 2F 0D 00 00 14 ..XE\W(...E/.... 1b0 : 90 CB 80 91 3E BB 69 6E 08 63 81 B5 EC 42 7B 1F ....>.in.c...B{. 1c0 : 0D 00 00 14 40 48 B7 D5 6E BC E8 85 25 E7 DE 7F ....@H..n...%. 1d0 : 00 D6 C2 D3 0D 00 00 14 FB 1D E3 CD F3 41 B7 EA .............A.. 1e0 : 16 B7 E5 BE 08 55 F1 20 0D 00 00 14 26 24 4D 38 .....U. ....&$M8 1f0 : ED DB 61 B3 17 2A 36 E3 D0 CF B8 19 00 00 00 14 ..a..*6......... 200 : E3 A5 96 6A 76 37 9F E7 07 22 82 31 E5 CE 86 52 ...jv7...".1...R ------------------------------------------------------------------------------ #(2 - 249267) [2010-05-19 13:54:52] [local/1000002] [snort/1:1000002] LOCAL Inbound Traffic to Unused UDP Ports -- BLOCKING SOURCE IPv4: 131.107.0.116 -> 91.121.75.197 hlen=5 TOS=0 dlen=556 ID=30484 flags=0 offset=0 TTL=46 chksum=59535 UDP: port=500 -> dport: 500 len=536 Payload: length = 528 000 : E4 B1 30 BD E0 2C 62 E6 00 00 00 00 00 00 00 00 ..0..,b......... 010 : 01 10 02 00 00 00 00 00 00 00 02 10 0D 00 01 64 ...............d 020 : 00 00 00 01 00 00 00 01 00 00 01 58 01 01 00 08 ...........X.... 030 : 03 00 00 30 01 01 00 00 80 01 00 05 80 02 00 02 ...0............ 040 : 80 04 00 02 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 050 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 060 : 03 00 00 30 02 01 00 00 80 01 00 05 80 02 00 01 ...0............ 070 : 80 04 00 02 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 080 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 090 : 03 00 00 30 03 01 00 00 80 01 00 01 80 02 00 02 ...0............ 0a0 : 80 04 00 01 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 0b0 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 0c0 : 03 00 00 30 04 01 00 00 80 01 00 01 80 02 00 01 ...0............ 0d0 : 80 04 00 01 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 0e0 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 0f0 : 03 00 00 24 05 01 00 00 80 01 00 05 80 02 00 02 ...$............ 100 : 80 04 00 02 80 03 00 03 80 0B 00 01 00 0C 00 04 ................ 110 : 00 00 1C 20 03 00 00 24 06 01 00 00 80 01 00 05 ... ...$........ 120 : 80 02 00 01 80 04 00 02 80 03 00 03 80 0B 00 01 ................ 130 : 00 0C 00 04 00 00 1C 20 03 00 00 24 07 01 00 00 ....... ...$.... 140 : 80 01 00 01 80 02 00 02 80 04 00 01 80 03 00 03 ................ 150 : 80 0B 00 01 00 0C 00 04 00 00 1C 20 00 00 00 24 ........... ...$ 160 : 08 01 00 00 80 01 00 01 80 02 00 01 80 04 00 01 ................ 170 : 80 03 00 03 80 0B 00 01 00 0C 00 04 00 00 1C 20 ............... 180 : 0D 00 00 18 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF .....+Qi...}|... 190 : B5 87 E4 61 00 00 00 08 0D 00 00 14 4A 13 1C 81 ...a........J... 1a0 : 07 03 58 45 5C 57 28 F2 0E 95 45 2F 0D 00 00 14 ..XE\W(...E/.... 1b0 : 90 CB 80 91 3E BB 69 6E 08 63 81 B5 EC 42 7B 1F ....>.in.c...B{. 1c0 : 0D 00 00 14 40 48 B7 D5 6E BC E8 85 25 E7 DE 7F ....@H..n...%. 1d0 : 00 D6 C2 D3 0D 00 00 14 FB 1D E3 CD F3 41 B7 EA .............A.. 1e0 : 16 B7 E5 BE 08 55 F1 20 0D 00 00 14 26 24 4D 38 .....U. ....&$M8 1f0 : ED DB 61 B3 17 2A 36 E3 D0 CF B8 19 00 00 00 14 ..a..*6......... 200 : E3 A5 96 6A 76 37 9F E7 07 22 82 31 E5 CE 86 52 ...jv7...".1...R ------------------------------------------------------------------------------ #(3 - 166066) [2010-05-19 14:14:04] [local/1000002] [snort/1:1000002] LOCAL Inbound Traffic to Unused UDP Ports -- BLOCKING SOURCE IPv4: 131.107.0.116 -> 94.23.207.114 hlen=5 TOS=0 dlen=556 ID=7519 flags=0 offset=0 TTL=47 chksum=47865 UDP: port=500 -> dport: 500 len=536 Payload: length = 528 000 : B2 CE E1 0A B9 B6 11 E6 00 00 00 00 00 00 00 00 ................ 010 : 01 10 02 00 00 00 00 00 00 00 02 10 0D 00 01 64 ...............d 020 : 00 00 00 01 00 00 00 01 00 00 01 58 01 01 00 08 ...........X.... 030 : 03 00 00 30 01 01 00 00 80 01 00 05 80 02 00 02 ...0............ 040 : 80 04 00 02 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 050 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 060 : 03 00 00 30 02 01 00 00 80 01 00 05 80 02 00 01 ...0............ 070 : 80 04 00 02 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 080 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 090 : 03 00 00 30 03 01 00 00 80 01 00 01 80 02 00 02 ...0............ 0a0 : 80 04 00 01 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 0b0 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 0c0 : 03 00 00 30 04 01 00 00 80 01 00 01 80 02 00 01 ...0............ 0d0 : 80 04 00 01 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 0e0 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 0f0 : 03 00 00 24 05 01 00 00 80 01 00 05 80 02 00 02 ...$............ 100 : 80 04 00 02 80 03 00 03 80 0B 00 01 00 0C 00 04 ................ 110 : 00 00 1C 20 03 00 00 24 06 01 00 00 80 01 00 05 ... ...$........ 120 : 80 02 00 01 80 04 00 02 80 03 00 03 80 0B 00 01 ................ 130 : 00 0C 00 04 00 00 1C 20 03 00 00 24 07 01 00 00 ....... ...$.... 140 : 80 01 00 01 80 02 00 02 80 04 00 01 80 03 00 03 ................ 150 : 80 0B 00 01 00 0C 00 04 00 00 1C 20 00 00 00 24 ........... ...$ 160 : 08 01 00 00 80 01 00 01 80 02 00 01 80 04 00 01 ................ 170 : 80 03 00 03 80 0B 00 01 00 0C 00 04 00 00 1C 20 ............... 180 : 0D 00 00 18 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF .....+Qi...}|... 190 : B5 87 E4 61 00 00 00 08 0D 00 00 14 4A 13 1C 81 ...a........J... 1a0 : 07 03 58 45 5C 57 28 F2 0E 95 45 2F 0D 00 00 14 ..XE\W(...E/.... 1b0 : 90 CB 80 91 3E BB 69 6E 08 63 81 B5 EC 42 7B 1F ....>.in.c...B{. 1c0 : 0D 00 00 14 40 48 B7 D5 6E BC E8 85 25 E7 DE 7F ....@H..n...%. 1d0 : 00 D6 C2 D3 0D 00 00 14 FB 1D E3 CD F3 41 B7 EA .............A.. 1e0 : 16 B7 E5 BE 08 55 F1 20 0D 00 00 14 26 24 4D 38 .....U. ....&$M8 1f0 : ED DB 61 B3 17 2A 36 E3 D0 CF B8 19 00 00 00 14 ..a..*6......... 200 : E3 A5 96 6A 76 37 9F E7 07 22 82 31 E5 CE 86 52 ...jv7...".1...R ------------------------------------------------------------------------------ #(1 - 363071) [2010-06-15 12:53:31] [local/1000002] [snort/1:1000002] LOCAL Inbound Traffic to Unused UDP Ports -- BLOCKING SOURCE IPv4: 131.107.0.116 -> 91.121.85.146 hlen=5 TOS=0 dlen=556 ID=3426 flags=0 offset=0 TTL=49 chksum=17781 UDP: port=500 -> dport: 500 len=536 Payload: length = 528 000 : E7 09 45 D5 62 CA 97 51 00 00 00 00 00 00 00 00 ..E.b..Q........ 010 : 01 10 02 00 00 00 00 00 00 00 02 10 0D 00 01 64 ...............d 020 : 00 00 00 01 00 00 00 01 00 00 01 58 01 01 00 08 ...........X.... 030 : 03 00 00 30 01 01 00 00 80 01 00 05 80 02 00 02 ...0............ 040 : 80 04 00 02 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 050 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 060 : 03 00 00 30 02 01 00 00 80 01 00 05 80 02 00 01 ...0............ 070 : 80 04 00 02 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 080 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 090 : 03 00 00 30 03 01 00 00 80 01 00 01 80 02 00 02 ...0............ 0a0 : 80 04 00 01 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 0b0 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 0c0 : 03 00 00 30 04 01 00 00 80 01 00 01 80 02 00 01 ...0............ 0d0 : 80 04 00 01 80 03 FD E9 80 0B 00 01 00 0C 00 04 ................ 0e0 : 00 00 1C 20 40 00 00 08 49 00 4B 00 45 00 00 00 ... @...I.K.E... 0f0 : 03 00 00 24 05 01 00 00 80 01 00 05 80 02 00 02 ...$............ 100 : 80 04 00 02 80 03 00 03 80 0B 00 01 00 0C 00 04 ................ 110 : 00 00 1C 20 03 00 00 24 06 01 00 00 80 01 00 05 ... ...$........ 120 : 80 02 00 01 80 04 00 02 80 03 00 03 80 0B 00 01 ................ 130 : 00 0C 00 04 00 00 1C 20 03 00 00 24 07 01 00 00 ....... ...$.... 140 : 80 01 00 01 80 02 00 02 80 04 00 01 80 03 00 03 ................ 150 : 80 0B 00 01 00 0C 00 04 00 00 1C 20 00 00 00 24 ........... ...$ 160 : 08 01 00 00 80 01 00 01 80 02 00 01 80 04 00 01 ................ 170 : 80 03 00 03 80 0B 00 01 00 0C 00 04 00 00 1C 20 ............... 180 : 0D 00 00 18 1E 2B 51 69 05 99 1C 7D 7C 96 FC BF .....+Qi...}|... 190 : B5 87 E4 61 00 00 00 08 0D 00 00 14 4A 13 1C 81 ...a........J... 1a0 : 07 03 58 45 5C 57 28 F2 0E 95 45 2F 0D 00 00 14 ..XE\W(...E/.... 1b0 : 90 CB 80 91 3E BB 69 6E 08 63 81 B5 EC 42 7B 1F ....>.in.c...B{. 1c0 : 0D 00 00 14 40 48 B7 D5 6E BC E8 85 25 E7 DE 7F ....@H..n...%. 1d0 : 00 D6 C2 D3 0D 00 00 14 FB 1D E3 CD F3 41 B7 EA .............A.. 1e0 : 16 B7 E5 BE 08 55 F1 20 0D 00 00 14 26 24 4D 38 .....U. ....&$M8 1f0 : ED DB 61 B3 17 2A 36 E3 D0 CF B8 19 00 00 00 14 ..a..*6......... 200 : E3 A5 96 6A 76 37 9F E7 07 22 82 31 E5 CE 86 52 ...jv7...".1...R