Symantec™ Security Gateways Reference Guide - Sawmill

302 IDS eventsIntrusion attemptsUnknown Protocol FloodBase Event:Details:Response:Affected:COUNTER_UNKPROTO_HIGHA large portion of layer 4 traffic on a link is of an unknown protocol. This is considered unusual,and might be an attempt to flood the target network. An attacker can send a large number ofpackets to the victim system or network in an attempt to consume most or all of the victim’snetwork capacity. It may also be an attempt to flood an application or service if targeted at aspecific address and port. In this case the protocol is not TCP or UDP.Responses to floods typically include installing some sort of temporary network filter to eliminatethe inbound packets and then locating and terminating the source of the flood. Note that in somefloods the source addresses of the flooding packets may be forged to make the location effort moredifficult.No specific targets.False Positives: It is possible for legitimate network applications which send large numbers of packets of anunknown protocol to be detected as floods.References:CERTWinnukeBase Event:Details:Response:Affected:SMB_OOB_DATA_WINNUKEA WinNuke attack has been detected. WinNuke is specifically designed to crash some versions ofthe Microsoft Windows operating system. The attacker sends a packet to the netbios port,triggering a bug in the Microsoft Windows networking system and causing the machine to crash.This typically affects only older, unpatched Microsoft Windows systems.Response to this attack typically includes applying a patch from the vendor to fix the vulnerabilityon the victim system. The source IP address of the attack may also be useful in locating the sourceof the attack and preventing further attacks.No specific targets.False Positives: None known.References:CVE-1999-0153Intrusion attemptsBack Orifice Web ServerBase Event:Details:Response:Affected:HTTP_RESPMSGHDR_SIG1The well known response of the back orifice backdoor was detected.Location and audit of client and server is recommended. The back door software should be removedfrom the server.No specific targets.False Positives: None known.References:CERT VN-98.07