Time value errors
Scot Harris <[email protected]> Wed, 18 Dec 2019 23:02:22 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <BY5PR09MB5154A55F991CDA0DA6450E9CA9530@BY5PR09MB5154.namprd09.prod.outlook.com> |
--===============0771163812==
Content-Language: en-US
Content-Type: multipart/related;
boundary="_004_BY5PR09MB5154A55F991CDA0DA6450E9CA9530BY5PR09MB5154namp_";
type="multipart/alternative"
--_004_BY5PR09MB5154A55F991CDA0DA6450E9CA9530BY5PR09MB5154namp_
Content-Type: multipart/alternative;
boundary="_000_BY5PR09MB5154A55F991CDA0DA6450E9CA9530BY5PR09MB5154namp_"
--_000_BY5PR09MB5154A55F991CDA0DA6450E9CA9530BY5PR09MB5154namp_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Noted what appear to be errors in the ntp.log file.
Using following command:
cat ntp.log | zeek-cut -d | less
af_packet::eno1 2019-12-18T17:44:39-0500 C7MULpTngYof10ymf 10.=
1.45.35 123 10.1.5.60 123 2 3 4 64.000=
000 0.000004 0.070786 0.113083 10.1.5.60 2=
019-12-18T17:43:35-0500 2019-12-18T17:43:35-0500 2019-12-18T1=
7:43:35-0500 2019-12-18T17:44:39-0500 0
af_packet::eno1 2019-12-18T17:44:39-0500 C7MULpTngYof10ymf 10.=
1.45.35 123 10.1.5.60 123 3 4 3 64.000=
000 0.015625 0.069839 0.077545 23.239.26.89 2=
019-:zeek-cut: time value out-of-range: -586465861.545972
zeek-cut: time value out-of-range: -586465861.545972
12-18T17:42:18-0500 2019-12-18T17:44:39-0500 2019-12-18T17:44=
:39-0500 2019-12-18T17:44:39-0500 0
af_packet::eno1 2019-12-18T17:44:39-0500 C5GF2T1ozzCZptCbjf 10.=
1.204.212 123 10.1.5.180 123 3 3 15 64.000=
000 0.007812 0.000000 2.009995 0.0.0.0 1969-12-3=
1T19:00:00-0500 1969-12-31T19:00:00-0500 1969-12-31T19:00:00-=
0500 2019-12-18T17:44:46-0500 0
af_packet::eno1 2019-12-18T17:44:40-0500 CxaJ6KeJfxVcN8Fw2 10.=
1.201.150 123 10.1.5.180 123 3 3 15 64.000=
000 0.007812 0.000000 2.009995 0.0.0.0 1969-12-3=
1T19:00:00-0500 1969-12-31T19:00:00-0500 1969-12-31T19:00:00-=
0500 2019-12-18T17:44:48-0500 0
af_packet::eno1 2019-12-18T17:44:40-0500 C8dZCI37SuYRZB9L7g 10.=
1.13.61 123 10.1.5.60 123 3 3 4 64.000=
000 0.007812 0.069839 0.402298 60.5.1.10 2=
019-12-18T17:43:37-0500 2019-12-18T17:43:36-0500 2019-12-18T1=
7:43:37-0500 2019-12-18T17:44:41-0500 0
af_packet::eno1 2019-12-18T17:44:41-0500 CBz4Ww4jjCjKgHYfwc 10.=
1.221.30 123 10.1.5.180 123 3 3 15 64.000=
000 0.007812 0.000000 2.009995 0.0.0.0 1969-12-3=
1T19:zeek-cut: time value out-of-range: -1114760693.379112
zeek-cut: time value out-of-range: -1114760693.379112
zeek-cut: time value out-of-range: -1115340513.842638
:00:00-0500 1969-12-31T19:00:00-0500 1969-12-31T19:00:00-0500=
2019-12-18T17:44:44-0500 0
af_packet::eno1 2019-12-18T17:44:40-0500 C4akh61szBCsYCPJn6 10.=
1.223.28 123 10.1.5.180 123 3 3 15 64.000=
000 0.007812 0.000000 2.009995 0.0.0.0 1969-12-3=
1T19:
Have not noticed these errors previously.
____________________________________________________
Scot Harris
Network Engineer | IT | City of Hollywood
(P) 954-921-3304 | [email protected]<mailto:[email protected]>
[CISSP_small]<https://www.youracclaim.com/badges/68100897-2eed-45c7-bc15-18=
53e5923e39/email>
--_000_BY5PR09MB5154A55F991CDA0DA6450E9CA9530BY5PR09MB5154namp_
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
<html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr=
osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" =
xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:=
//www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"=
>
<meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72">
<div class=3D"WordSection1">
<p class=3D"MsoNormal">Noted what appear to be errors in the ntp.log file.<=
o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Using following command:<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">cat ntp.log | zeek-cut –d | less<o:p></o:p></p=
>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">af_packet::eno1 2019-12-18T17:44:39-0500 =
C7MULpTngYof10ymf &nb=
sp; 10.1.45.35 123 &nb=
sp; 10.1.5.60 123 &nbs=
p; 2 3 &nb=
sp; 4 64.000000 =
0.000004 0.070786&nb=
sp; 0.113083 &nb=
sp; 10.1.5.60 2019-12-18T17=
:43:35-0500
2019-12-18T17:43:35-0500 2019-12=
-18T17:43:35-0500 2019-12-18T17:4=
4:39-0500 0<o:p></o:p></p>
<p class=3D"MsoNormal">af_packet::eno1 2019-12-18T17:44:39-0500 =
C7MULpTngYof10ymf &nb=
sp; 10.1.45.35 123 &nb=
sp; 10.1.5.60 123 &nbs=
p; 3 4 &nb=
sp; 3 64.000000 =
0.015625 0.069839&nb=
sp; 0.077545 &nb=
sp; 23.239.26.89 2019-:<span style=3D"backgro=
und:yellow;mso-highlight:yellow">zeek-cut:
time value out-of-range: -586465861.545972<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"background:yellow;mso-highlight:yello=
w">zeek-cut: time value out-of-range: -586465861.545972</span><o:p></o:p></=
p>
<p class=3D"MsoNormal">12-18T17:42:18-0500 &nb=
sp; 2019-12-18T17:44:39-0500  =
; 2019-12-18T17:44:39-0500 2019-1=
2-18T17:44:39-0500 0<o:p></o:p></=
p>
<p class=3D"MsoNormal">af_packet::eno1 2019-12-18T17:44:39-0500 =
C5GF2T1ozzCZptCbjf &n=
bsp; 10.1.204.212 123 10.1.5.180&=
nbsp; 123 3 &nbs=
p; 3 15 &n=
bsp; 64.000000 0.007812&nbs=
p; 0.000000 &nbs=
p; 2.009995 0.0.0.0 1=
969-12-31T19:00:00-0500
1969-12-31T19:00:00-0500 1969-12=
-31T19:00:00-0500 2019-12-18T17:4=
4:46-0500 0<o:p></o:p></p>
<p class=3D"MsoNormal">af_packet::eno1 2019-12-18T17:44:40-0500 =
CxaJ6KeJfxVcN8Fw2 &nb=
sp; 10.1.201.150 123 10.1.5=
.180 123 3  =
; 3 15 &nb=
sp; 64.000000 0.00781=
2 0.000000  =
; 2.009995 0.0.=
0.0 1969-12-31T19:00:00-0500
1969-12-31T19:00:00-0500 1969-12=
-31T19:00:00-0500 2019-12-18T17:4=
4:48-0500 0<o:p></o:p></p>
<p class=3D"MsoNormal">af_packet::eno1 2019-12-18T17:44:40-0500 =
C8dZCI37SuYRZB9L7g &n=
bsp; 10.1.13.61 123 1=
0.1.5.60 123 3&=
nbsp; 3 4=
64.000000  =
; 0.007812 0.069839 &n=
bsp; 0.402298 &n=
bsp; 60.5.1.10 2019-12-18T17:43:3=
7-0500
2019-12-18T17:43:36-0500 2019-12=
-18T17:43:37-0500 2019-12-18T17:4=
4:41-0500 0<o:p></o:p></p>
<p class=3D"MsoNormal">af_packet::eno1 2019-12-18T17:44:41-0500 =
CBz4Ww4jjCjKgHYfwc &n=
bsp; 10.1.221.30 123 10.1.5=
.180 123 3  =
; 3 15 &nb=
sp; 64.000000 0.00781=
2 0.000000  =
; 2.009995 0.0.=
0.0 1969-12-31T19:<span style=3D"background:yellow;mso-highlight:yellow">ze=
ek-cut:
time value out-of-range: -1114760693.379112<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"background:yellow;mso-highlight:yello=
w">zeek-cut: time value out-of-range: -1114760693.379112<o:p></o:p></span><=
/p>
<p class=3D"MsoNormal"><span style=3D"background:yellow;mso-highlight:yello=
w">zeek-cut: time value out-of-range: -1115340513.842638</span><o:p></o:p><=
/p>
<p class=3D"MsoNormal">:00:00-0500  =
; 1969-12-31T19:00:00-0500 1969-1=
2-31T19:00:00-0500 2019-12-18T17:=
44:44-0500 0<o:p></o:p></p>
<p class=3D"MsoNormal">af_packet::eno1 2019-12-18T17:44:40-0500 =
C4akh61szBCsYCPJn6 &n=
bsp; 10.1.223.28 123 10.1.5=
.180 123 3  =
; 3 15 &nb=
sp; 64.000000 0.00781=
2 0.000000  =
; 2.009995 0.0.=
0.0 1969-12-31T19:<o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal">Have not noticed these errors previously.<o:p></o:p>=
</p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">_______________________________________=
_____________<br>
</span><b><span style=3D"font-size:10.0pt;font-family:"Verdana",s=
ans-serif;color:black">Scot Harris</span></b><span style=3D"font-size:10.0p=
t;font-family:"Verdana",sans-serif;color:black"><br>
Network Engineer | IT | City of Hollywood<o:p></o:p></span></p>
<p class=3D"MsoNormal"><span style=3D"font-size:10.0pt;font-family:"Ve=
rdana",sans-serif;color:black">(P) 954-921-3304 |
<u><a href=3D"mailto:[email protected]">[email protected]</a></=
u><o:p></o:p></span></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
<p class=3D"MsoNormal"><a href=3D"https://www.youracclaim.com/badges/681008=
97-2eed-45c7-bc15-1853e5923e39/email"><span style=3D"color:windowtext;text-=
decoration:none"><img border=3D"0" width=3D"44" height=3D"44" id=3D"Picture=
_x0020_1" src=3D"cid:[email protected]" alt=3D"CISSP_small"></=
span></a><o:p></o:p></p>
<p class=3D"MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>
--_000_BY5PR09MB5154A55F991CDA0DA6450E9CA9530BY5PR09MB5154namp_--
--_004_BY5PR09MB5154A55F991CDA0DA6450E9CA9530BY5PR09MB5154namp_
Content-Type: image/png; name="image001.png"
Content-Description: image001.png
Content-Disposition: inline; filename="image001.png"; size=1475;
creation-date="Wed, 18 Dec 2019 23:02:21 GMT";
modification-date="Wed, 18 Dec 2019 23:02:21 GMT"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64
iVBORw0KGgoAAAANSUhEUgAAACwAAAAsCAYAAAAehFoBAAAAAXNSR0IArs4c6QAAAARnQU1BAACx
jwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAVYSURBVFhH7ZkLTJVlGMd/53COyP14QRDBZGIs
JcsbXsBmCKlQXhIbqClhpZgOECpJbZGX1GRe8kLN+3K5OdJcuuymc5a6mXm3CwozhhdIkYuHi3B6
3u8cyhmHtO0ktvPbvh2+93vf9/vzvP/nebf301kEBPPtOnL2bqehoQG9TqeaHjgNIk2v15MRm4Cb
wai1aYK3HtrH5CXpEBismrQHLQeJZ1EBW95czqTIYejKa6ot3mN7Q7cwedZg69TC0Onh1zOU5x3H
xa1PyDv7S4vBxWB72hKRKHt44tYgFqmorZWGlmaDptChtOpdxNQPC0rrw6PWhlOwo3EKdjROwY7G
KdjROAU7GqdgR+MU7Gicgh2NU7CjcQp2NP9Twer4raYaqm/JrxkabCdEt29DnTrXELQ+8kz1Ue2N
qOeqrVbGK9Tpkpqr8aq/q++d903wz4JvVUHZ72QNHcmqUZOZF/28CKqDmzcY3Lkr43r2t774+jWy
Y+JZN+YlgkxtrS8vuUxs6JNa29T+Q6VPCa56A7MGD2fGoBjSnxqBv5ePzHUdysu0uR7r0KlZ0c0L
FqHxfQdj2byf5H7DMFiMjBkUjWXNbqJ6hhMX+gTLElLg4jksWw+SIAKMIvbS/A1wrZgVSRnsmZlN
lWtrciel8dGkVAw6HTmJrxEbPoT4gTFcXriZ5KiRRHbvzYSIZ5gSORwqKmwC/o79AzWJ4sDQnux4
JYtu2VPJP3IIzDoIbi//poGAjp2J6hJKScVNgntFakNCYx+FsHDSP14tMxtJjR5DUEYCRaVXyFyT
TUiPPrgarK+MTXkW/AOJ6zeEz9MWoYsLJSwohLKqm+DmpvVpCvsRlmXaNm0ua77dRX7BL9A9DPr2
AJMveJkoluU2uujlMlBw/kdtSM6CjZo1KpRPJarfF/zM6UWbQJ03S+TzS65gbDwaU76urCCwQ4D1
3tNE7v5dbD92UBtrDzuC5QVmM8Gm9nx64ohM5m1NtHpbsikBthfr1TmiuwfBbyUxK2Yslp0nCXLz
AA8vIuYmUyS+VZaaE5sIpZetYwXLd6VYPjtN7vgZ9FmaCb5+0NodWrlqz+1hR7BkvG3pQkzt/qoK
dyJd/kSWv7CyHN3YXnxx8jCXlm6zVoX2/jyeFs+gJRksGJ1Eyqgkys0SWcFv1gv0WpyKbkIExwt/
AmPzQhuxbwlvEyu+zOPD5Neh6KK1EqjqUFsjkboqf9dqlUwd66toapke0IURmeO5IeUt7ennZIyU
ubYdOHz+B17MXcC8kRMxV5Vr01+7cI4Txb+BsoSrfc/ejX3B7p6kb1iCua4Oy+6zTOs/hDC/QKb0
jiR/VR4r41+lSsTrZIn9PDyxbDlAeEBnYuMSaSMCVny1C0vuXl4eEEWXTsG8lzidA2eOYVTLrlDf
LGyreD/YF6wIeAT3iRG8kbee+eOmcXruat6fMJNvTh0ldedGKiXiKpGuFhWy6uudHM1ayR7J+BFr
s7XViF6exTyxQsHCTZy6dIHxH8zBx0PyQaES605b3SO62TvWWxZLJWguM6mWpa2UciPR1iLjIUnl
5mnbwcQiPuLzW5VSP8us/dvIfSuZT20e5Tes4yQx8W5j3RQkETUrKDvdK2LJ2VGj0dc3lVB301o8
JglExyDJZvl1F8+qbFfVwEd2NRUqJchPdil1KbEKYytoJ9kv9VYTq1DfUnw73p9YG0qr3suovn/9
i7X5z7GgtOpKqiosvokDoKtsCi35s9eFs5R8csT6YTFn3w4y172rlaUWSXEhy1LeJmPYOKtg1XZF
Cv9aEV4jPnERfz5ok6j9sF6kucqOOl2E+qvdFvgDfp7pA5gFveIAAAAASUVORK5CYII=
--_004_BY5PR09MB5154A55F991CDA0DA6450E9CA9530BY5PR09MB5154namp_--
--===============0771163812==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek
--===============0771163812==--