Symantec™ Security Gateways Reference Guide - Sawmill

356 IDS eventsProbesAffected:No specific targets.False Positives: None known.References: http://www.whitehats.com (arachNIDS #375)http://www.whitehats.com (arachNIDS #375)FTP SpecificationsFTP ProbingBase Event:Details:Response:Affected:FTPCLI_SAINT_SCANAn FTP scan from Saint was detected (a “PASS” was issued with the string “-saint@” in theargument). Saint is a system administration tool intended to aid in diagnosing security risks. It isused by attackers to gather vulnerability information about your systems.Location and audit of client is recommended.No specific targets.False Positives: None known.FTP ProbingBase Event:Details:Response:Affected:FTPCLI_SATAN_SCANAn FTP scan from SATAN was detected (a “PASS” was issued with the string “-satan@” in theargument). SATAN is a system administration tool intended to aid in diagnosing security risks.Attackers use it to gather vulnerability information about your systems.Location and audit of client is recommended.No specific targets.False Positives: None known.References: http://www.whitehats.com (arachNIDS #329)PortscanBase Event:Details:Response:Affected:COUNTER_TCP_PORTSCANA TCP port scan was detected. A port scan is typically an information gathering or probingattempt. An attacker will use a scan to determine which network ports have programs listening onthem. An attacker can also identify the application and target operating system. This informationis used to focus subsequent attacks.Port scans may vary in method and timing. An attacker often uses these variations in an attempt toevade or penetrate defensive measures such as security gateways or intrusion detection systems.Port scans are detected by monitoring patterns in TCP connection activity in a given network andobserving activity characteristic of a port scan.Responses to TCP port scans typically include locating the source of the scan and identifying theoperator. Note that in many scans some of the source addresses are forged to make the locationeffort more difficult. If the origin of the scan appears to cross a security gateway or other perimeterfilter, responses may also include review and modification of that devices configuration to preventfuture successful scanning attempts.No specific targets.False Positives: It is possible for some legitimate network management tools which perform network probing to bedetected as port scans.