Symantec™ Security Gateways Reference Guide - Sawmill

IDS eventsSuspicious activity391Ident Malformed DataBase Event:Details:Response:Affected:IDENT_BAD_PORTNUMBERSA port number that doesn’t correspond to any existing connection was specified in an identrequest. This may be an information gathering or attempt or it may just be a latent request for anold connection.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: None known.ReferencesIdent SpecificationsIdent Malformed DataBase Event:Details:Response:Affected:IDENT_BAD_REQUESTAn ident request that does not conform to the specification was detected. This may indicate aninformation gathering attempt.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: It is possible this is a non-compliant ident implementation.ReferencesIdent SpecificationsIdent Malformed DataBase Event:Details:Response:Affected:IDENT_BAD_RESPONSEA response was detected that does not conform to the ident RFC. This may indicate a compromisedident server.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: It is possible this is a non-compliant ident implementation.ReferencesIdent SpecificationsIdent Malformed DataBase Event:Details:Response:Affected:IDENT_BAD_USERNAMEThe user name in an ident response did not conform to the protocol specification. This mayindicate a compromised ident server.If seen in sufficient volume or variation, audit of client and server is recommended.No specific targets.False Positives: It is possible this is a non-compliant ident implementation.ReferencesIdent Specifications