Re: GIAC GCIA Version 3.5 Practical Detect #1 - Scott Hazel
Dana Webber <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
On Saturday 16 October 2004 14:41, opiesan wrote: > This detect focuses on a destination address of 226.185.106.59. The class B range of 226.185.0.0 appears to be the home network for the sensor that created this dump file. Grep’ing the file mac2ip.txt shows this range exists in every line of the dump file: > > grep –c 226.185 mac2ip.txt > 209187 > How do you know it did not incorrectly count an IP like 10.10.226.185 ? -- Dana Webber [email protected] http://dunrobin.dyn.dhs.org Getting a computer system to work is like banging your head against a brick wall until the wall falls down. _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions