■あまてらす
----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------
60.43.33.153 i60-43-33-153.s30.a048.ap.plala.or.jp
61.113.203.105 p1105-dng25tutuji.miyagi.ocn.ne.jp
61.116.142.48 SKNfa-03p3-48.ppp11.odn.ad.jp
61.116.160.155 AKAfa-01p8-155.ppp11.odn.ad.jp
61.117.15.117 M015117.ppp.dion.ne.jp
61.120.171.136 p78ab88.aomrnt01.ap.so-net.ne.jp
61.120.175.39 p78af27.ibrknt01.ap.so-net.ne.jp
61.121.60.57 ntiwte035057.iwte.nt.ftth.ppp.infoweb.ne.jp
61.123.82.141 SODfa-01p3-141.ppp11.odn.ad.jp
61.123.89.157 AOBfb-02p1-157.ppp11.odn.ad.jp
61.124.202.239 ntfkok015239.fkok.nt.adsl.ppp.infoweb.ne.jp
61.125.18.232 m61-125-18-232.megafit.me-h.ne.jp
61.125.35.9 z9.61-125-35.ppp.wakwak.ne.jp
61.125.65.2 zaq3d7d4102.zaq.ne.jp
61.125.65.19 zaq3d7d4113.zaq.ne.jp
61.125.67.122 zaq3d7d437a.zaq.ne.jp
61.125.67.233 zaq3d7d43e9.zaq.ne.jp
61.125.68.66 zaq3d7d4442.zaq.ne.jp
61.125.76.51 zaq3d7d4c33.zaq.ne.jp
61.125.76.205 zaq3d7d4ccd.zaq.ne.jp
61.125.78.68 zaq3d7d4e44.zaq.ne.jp
61.125.81.40 zaq3d7d5128.zaq.ne.jp
61.125.82.44 zaq3d7d522c.zaq.ne.jp
61.125.85.143 zaq3d7d558f.zaq.ne.jp
61.125.90.16 zaq3d7d5a10.zaq.ne.jp
61.125.90.87 zaq3d7d5a57.zaq.ne.jp
61.125.90.156 zaq3d7d5a9c.zaq.ne.jp
61.125.91.130 zaq3d7d5b82.zaq.ne.jp
61.125.92.216 zaq3d7d5cd8.zaq.ne.jp
61.125.95.209 zaq3d7d5fd1.zaq.ne.jp
61.125.97.27 zaq3d7d611b.zaq.ne.jp
61.125.98.7 zaq3d7d6207.zaq.ne.jp
61.125.101.63 zaq3d7d653f.zaq.ne.jp
61.125.103.83 zaq3d7d6753.zaq.ne.jp
61.125.103.118 zaq3d7d6776.zaq.ne.jp
61.125.105.31 zaq3d7d691f.zaq.ne.jp
61.125.105.122 zaq3d7d697a.zaq.ne.jp
61.125.107.102 zaq3d7d6b66.zaq.ne.jp
61.125.110.222 zaq3d7d6ede.zaq.ne.jp
61.125.110.240 zaq3d7d6ef0.zaq.ne.jp
61.125.111.192 zaq3d7d6fc0.zaq.ne.jp
61.125.124.98 zaq3d7d7c62.zaq.ne.jp
61.125.125.195 zaq3d7d7dc3.zaq.ne.jp
61.125.152.11 pc4b011.ztv.ne.jp
61.125.152.166 pc4b166.ztv.ne.jp
61.125.192.177 i192177.ppp.asahi-net.or.jp
61.125.194.30 i194030.ppp.asahi-net.or.jp
61.125.195.119 i195119.ppp.asahi-net.or.jp
61.125.197.146 i197146.ppp.asahi-net.or.jp
61.125.197.202 i197202.ppp.asahi-net.or.jp
61.125.201.112 i201112.ppp.asahi-net.or.jp
61.125.202.157 i202157.ppp.asahi-net.or.jp
61.125.204.250 i204250.ppp.asahi-net.or.jp
61.125.212.20 i212020.ppp.asahi-net.or.jp
61.125.212.25 i212025.ppp.asahi-net.or.jp
61.125.213.218 i213218.ppp.asahi-net.or.jp
61.125.213.251 i213251.ppp.asahi-net.or.jp
61.125.224.56 i224056.ppp.asahi-net.or.jp
61.125.224.185 i224185.ppp.asahi-net.or.jp
61.125.225.104 i225104.ppp.asahi-net.or.jp
61.125.226.117 i226117.ppp.asahi-net.or.jp
61.125.230.49 i230049.ppp.asahi-net.or.jp
61.125.230.133 i230133.ppp.asahi-net.or.jp
61.125.238.62 i238062.ppp.asahi-net.or.jp
61.125.251.93 i251093.ppp.asahi-net.or.jp
61.125.251.185 i251185.ppp.asahi-net.or.jp
61.195.14.7 PPPa7.hiroshima-ip.dti.ne.jp
61.197.59.140 pl396.nas921.nagasaki.nttpc.ne.jp
125.30.12.70 70.12.30.125.dy.iij4u.or.jp
202.226.234.67 ppp1591.hakata02.bbiq.jp
210.153.231.83 pl083.nas922.yamaguchi.nttpc.ne.jp
211.10.222.203
221.113.18.101 p018101.ppp.asahi-net.or.jp
221.113.31.71 p031071.ppp.asahi-net.or.jp
- traffic_summary.py 0.17(2005-07-20)
Report Settings:
- Honeynet: 192.168.37.0/24
- Starting Date: 20051221 (inclusive)
- Ending Date: 20051222 (exclusive)
- Number of days: 1
- Output file: /tmp/.sum.lpo10889
Total pcap records processed: 32,765
Total snort records processed: 12,008
========================================
Summary
=======
Remote IP Count: 4,993
Ports Scanned: 868
Connection Packets Packets Bytes Bytes
Type Count In Out In Out
-------- --------- --------- --------- --------- ---------
Inbound 9888 86897 71968 5106050 3312818
Outbound 4500 11727 11727 872047 872047
Total Snort SIDs: 24
Total Snort Alerts: 12008
========================================
Top 10 Snort Alerts
===================
Count SID Alert Description
----- ------ ---------------------------------
4743 46 (snort_decoder) WARNING: TCP Data Offset is less than 5!
4176 2 (spp_stream4) possible EVASIVE RST detection
1835 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflo
w attempt
407 1390 SHELLCODE x86 inc ebx NOOP
311 402 ICMP Destination Unreachable Port Unreachable
203 399 ICMP Destination Unreachable Host Unreachable
199 2924 NETBIOS SMB-DS repeated logon failure
45 2466 NETBIOS SMB-DS IPC$ unicode share access
31 2403 NETBIOS SMB Session Setup AndX request unicode username overflow a
ttempt
14 2472 NETBIOS SMB-DS C$ unicode share access
11 528 BAD-TRAFFIC loopback traffic
========================================
All Snort Alerts
================
Count SID Alert Description
----- ------ ---------------------------------
4176 2 (spp_stream4) possible EVASIVE RST detection
1 15 (http_inspect) OVERSIZE REQUEST-URI DIRECTORY
2 16 (spp_stream4) TCP CHECKSUM CHANGED ON RETRANSMISSION (possible fra
groute) detection
4743 46 (snort_decoder) WARNING: TCP Data Offset is less than 5!
203 399 ICMP Destination Unreachable Host Unreachable
311 402 ICMP Destination Unreachable Port Unreachable
4 485 ICMP Destination Unreachable Communication Administratively Prohib
ited
11 528 BAD-TRAFFIC loopback traffic
1 538 NETBIOS SMB IPC$ unicode share access
1 648 SHELLCODE x86 NOOP
1 895 WEB-CGI redirect access
2 1042 WEB-IIS view source via translate header
2 1070 WEB-MISC WebDAV search access
407 1390 SHELLCODE x86 inc ebx NOOP
2 1852 WEB-MISC robots.txt access
6 2049 MS-SQL ping attempt
1 2091 WEB-IIS WEBDAV nessus safe scan attempt
5 2251 NETBIOS DCERPC Remote Activation bind attempt
31 2403 NETBIOS SMB Session Setup AndX request unicode username overflow a
ttempt
1835 2404 NETBIOS SMB-DS Session Setup AndX request unicode username overflo
w attempt
45 2466 NETBIOS SMB-DS IPC$ unicode share access
14 2472 NETBIOS SMB-DS C$ unicode share access
199 2924 NETBIOS SMB-DS repeated logon failure
5 3276 NETBIOS DCERPC IActivation little endian bind attempt
========================================
Top 10 Remote IPs:
==================
Remote IP Packets Bytes Conns
--------------- --------- --------- ---------
218.91.255.139 22645 853402 6570
61.125.195.119 91780 2778355 3397
220.166.175.165 16099 12413 3031
193.126.38.227 13654 833953 1388
211.10.222.203 13198 856181 1307
212.246.91.233 5965 374601 589
202.224.32.1 885 47037 440
4.248.216.126 6673 479786 365
61.125.67.233 3158 107871 275
60.216.22.126 2756 81900 239
========================================
Top 10 Scanned Ports:
=====================
Port Packets Bytes Conns
--------- --------- --------- ---------
tcp/1433 98088 2966680 3961
tcp/139 16023 932750 2382
tcp/445 38013 3869597 1995
udp/1026 169 77466 153
tcp/135 1180 33166 138
udp/1027 134 60585 122
tcp/1025 1258 146720 105
tcp/1234 2420 197168 65
tcp/80 389 125190 33
udp/137 46 8073 24
========================================