Re: IPV six
Jonathan Lee via Snort-users <[email protected]> Tue, 14 Oct 2025 08:51:20 -0700
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
--===============4119385796890706589== Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html class=3D"apple-mail-supports-explicit-dark-mode"><head><meta http-equi= v=3D"content-type" content=3D"text/html; charset=3Dutf-8"></head><body dir=3D= "auto">I will have to generate a pcap file I am in school so I will not be a= ble to do this anytime soon as midterms are going on. But it seems to work b= etter when router advertisements are set to stateless for dhcpv6 again I am u= sing hurricane electric ipv6 tunnel <br id=3D"lineBreakAtBeginningOfSi= gnature"><div dir=3D"ltr">Sent from my iPhone</div><div dir=3D"ltr"><br><blo= ckquote type=3D"cite">On Oct 14, 2025, at 05:31, Anna Norokh -X (anorokh - S= OFTSERVE INC at Cisco) <[email protected]> wrote:<br><br></blockquote>= </div><blockquote type=3D"cite"><div dir=3D"ltr">=EF=BB=BF <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8"> <div dir=3D"ltr" style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; f= ont-size: 12pt; color: rgb(0, 0, 0);"> Hello </div> <div dir=3D"ltr" style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; f= ont-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div dir=3D"ltr" style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; f= ont-size: 12pt; color: rgb(0, 0, 0);"> Could you please capture and share the traffic related to the app ID activit= y you mentioned?</div> <div dir=3D"ltr" style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; f= ont-size: 12pt; color: rgb(0, 0, 0);"> <br> Both the IPv4 and IPv6 traffic that you are seeing would be helpful. This wi= ll help understand the possible issue and suggest detection profiles that co= uld be configured.</div> <div dir=3D"ltr" style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; f= ont-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div dir=3D"ltr"><br> </div> <div dir=3D"ltr" style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; f= ont-size: 12pt;"> Regards,</div> <div dir=3D"ltr" style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; f= ont-size: 12pt;"> Anna</div> <div dir=3D"ltr" style=3D"font-family: Aptos, Arial, Helvetica, sans-serif; f= ont-size: 12pt; color: rgb(0, 0, 0);"> <br> </div> <div id=3D"ms-outlook-mobile-signature" style=3D"color: inherit; background-= color: inherit;"> <p dir=3D"ltr" style=3D"margin: 0in 0in 0.0001pt; font-family: Aptos, sans-s= erif; font-size: 12pt;"> Get <a href=3D"https://aka.ms/GetOutlookForMac" data-outlook-id=3D"472a10d9-= 7c6e-4f4c-8deb-59c8685543e9" style=3D"margin-top: 0px; margin-bottom: 0px;">= Outlook for Mac </a></p> </div> <div id=3D"mail-editor-reference-message-container" style=3D"color: inherit;= background-color: inherit;"> <div dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing">= </div> <div class=3D"ms-outlook-mobile-reference-message skipProofing" style=3D"tex= t-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; border= -style: solid none none; border-color: rgb(181, 196, 223) currentcolor curre= ntcolor; font-family: Aptos; font-size: 12pt; color: black;"> <b>From: </b>Snort-users <[email protected]> on beha= lf of Jonathan Lee via Snort-users <[email protected]><br> <b>Date: </b>Monday, 6 October 2025 at 15:05<br> <b>To: </b>Snort-users <[email protected]><br> <b>Subject: </b>Re: [Snort-users] IPV six<br> <br> </div> <div class=3D"ms-outlook-mobile-reference-message skipProofing">Hello all is= there anything I should check I only see one or two a week right now <= /div> <div dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing">= Sent from my iPhone</div> <div dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing">= <br> </div> <blockquote> <div dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing">= On Sep 30, 2025, at 07:26, Jonathan Lee <[email protected]> wro= te:<br> <br> </div> </blockquote> <blockquote> <div dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing">= =EF=BB=BF</div> <p dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing"><b= >Hi,</b></p> <p dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing">I'= m observing some IPv6 activity being detected, but IPv4 traffic is significa= ntly more prevalent. Is there anything in particular I should be investigati= ng on this front?</p> <p dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing">IP= v6 traffic does appear when app ID-related activity is detected, but in term= s of potential threats=E2=80=94especially from the perspective of invasive a= ctors and official Snort signatures=E2=80=94I'm not seeing many relevant detections tied to IPv6.</p> <p dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing">Th= anks!</p> <div dir=3D"ltr" class=3D"ms-outlook-mobile-reference-message skipProofing">= Sent from my iPhone</div> </blockquote> </div> </div></blockquote></body></html>= --===============4119385796890706589== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette --===============4119385796890706589==--