Re: Details and Explanation for "POLICY-OTHER HTTP request by IPv4 address attempt" and "PROTOCOL-SCADA IEC 104"

Hi - send to the snort-sigs list for help with rules.
________________________________
From: Snort-users <[email protected]> on behalf of Sriakhil Gogineni <[email protected]>
Sent: Monday, January 23, 2023 12:55 PM
To: [email protected] <[email protected]>
Subject: [Snort-users] Details and Explanation for "POLICY-OTHER HTTP request by IPv4 address attempt" and "PROTOCOL-SCADA IEC 104"

Hello,

New user to snort. Installed snort3 on openwrt 22.03 with the registered (not subscription) user rules.

I've been monitoring snort and see two types of messages:

Mon Jan 23 08:40:30 2023 auth.info snort: "POLICY-OTHER HTTP request by IPv4 address attempt"
Mon Jan 23 08:42:03 2023 auth.info snort: "POLICY-OTHER HTTP request by IPv4 address attempt"
Mon Jan 23 08:43:35 2023 auth.info snort: "POLICY-OTHER HTTP request by IPv4 address attempt"

Every few minutes with some delays in between.

How can I find more details on these alerts?
e.g. whats the source and destination IPs?

The other logs I see are:

Mon Jan 23 08:27:48 2023 auth.info snort: [1:41075:4] "PROTOCOL-SCADA IEC 104 counter interrogation command" [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} UNKNOWN_A:2404 -> MY_IP:LOCAL_PORT
Mon Jan 23 08:27:48 2023 auth.info snort: [1:41069:4] "PROTOCOL-SCADA IEC 104 Single command" [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} UNKNOWN_A:2404 -> MY_IP:LOCAL_PORT
Mon Jan 23 08:27:48 2023 auth.info snort: [1:41063:4] "PROTOCOL-SCADA IEC 104 Parameter value" [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} UNKNOWN_A:2404 -> MY_IP:LOCAL_PORT
Mon Jan 23 08:34:43 2023 auth.info snort: [1:41068:4] "PROTOCOL-SCADA IEC 104 Set point command" [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} MY_IP:LOCAL_PORT -> UNKNOWN_B:2404
Mon Jan 23 08:34:43 2023 auth.info snort: [1:41075:4] "PROTOCOL-SCADA IEC 104 counter interrogation command" [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} UNKNOWN_B:2404 -> MY_IP:LOCAL_PORT
Mon Jan 23 08:34:43 2023 auth.info snort: [1:41069:4] "PROTOCOL-SCADA IEC 104 Single command" [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} UNKNOWN_B:2404 -> MY_IP:LOCAL_PORT
Mon Jan 23 08:34:43 2023 auth.info snort: [1:41063:4] "PROTOCOL-SCADA IEC 104 Parameter value" [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} UNKNOWN_B:2404 -> MY_IP:LOCAL_PORT

I don't think I have any SCADA devices on my network. The local port forwards to a debian server with an unrelated service, e.g. DDNS.

Why would my system respond to these requests? Is it a mischaracterization? The docs say no false positives for these rules.

Advice and pointers to relevant docs would be appreciated. Thank you.
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette