From owner-FreeBSD-net-jp@jp.FreeBSD.org Tue Mar 19 19:15:45 2002
Received: (from daemon@localhost)
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) id g2JAFj024744;
	Tue, 19 Mar 2002 19:15:45 +0900 (JST)
	(envelope-from owner-FreeBSD-net-jp@jp.FreeBSD.org)
Received: from server.t.kanazawa-u.ac.jp (server.t.kanazawa-u.ac.jp [133.28.12.20])
	by castle.jp.FreeBSD.org (8.11.6+3.4W/8.11.3) with ESMTP/inet id g2JAFjc24739
	for <FreeBSD-net-jp@jp.FreeBSD.org>; Tue, 19 Mar 2002 19:15:45 +0900 (JST)
	(envelope-from hirano@t.kanazawa-u.ac.jp)
Received: from fw-t (fw-t-dmz [10.12.2.1])
	by server.t.kanazawa-u.ac.jp (8.12.1/8.12.1) with SMTP id g2JAEwGi001657
	for <FreeBSD-net-jp@jp.FreeBSD.org>; Tue, 19 Mar 2002 19:14:58 +0900 (JST)
Received: from pegasus.ec.t.kanazawa-u.ac.jp (pegasus.ec.t.kanazawa-u.ac.jp [133.28.119.43])
	by proxy.or.t.kanazawa-u.ac.jp (8.11.6/8.11.6) with ESMTP id g2JAGmP21561
	for <FreeBSD-net-jp@jp.FreeBSD.org>; Tue, 19 Mar 2002 19:16:48 +0900 (JST)
Received: from localhost (hirano@pisces.ec.t.kanazawa-u.ac.jp [133.28.119.45])
	by pegasus.ec.t.kanazawa-u.ac.jp (8.11.6/8.11.6) with ESMTP id g2JAEf146806
	for <FreeBSD-net-jp@jp.FreeBSD.org>; Tue, 19 Mar 2002 19:14:41 +0900 (JST)
	(envelope-from hirano@t.kanazawa-u.ac.jp)
Date: Tue, 19 Mar 2002 19:16:53 +0900 (JST)
Message-Id: <20020319.191653.21903715.hirano@t.kanazawa-u.ac.jp>
To: FreeBSD-net-jp@jp.FreeBSD.org
From: Akihiro HIRANO <hirano@t.kanazawa-u.ac.jp>
In-Reply-To: <200203190825.RAA15264@ceres.t.ecl.net>
References: <20020319163550.9A07.UEDA@Raomen.Net>
	<200203190825.RAA15264@ceres.t.ecl.net>
X-Mailer: Mew version 2.0 on Emacs 20.7 / Mule 4.0 (HANANOEN)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-2022-jp
Content-Transfer-Encoding: 7bit
Reply-To: FreeBSD-net-jp@jp.FreeBSD.org
Precedence: list
X-Distribute: distribute version 2.1 (Alpha) patchlevel 24e+020312
X-Sequence: FreeBSD-net-jp 3612
Subject: [FreeBSD-net-jp 3612] Re: =?ISO-2022-JP?B?GyRCJVElMSVDJUgbKEI=?=
 =?ISO-2022-JP?B?GyRCJE4yIzxoJGobKEI=?=(?)
 =?ISO-2022-JP?B?GyRCJHIkNyRGISIbKEI=?= Web
 =?ISO-2022-JP?B?GyRCJSIlLyU7JTklbSUwJHI8aCRqJD8kJBsoQg==?= 
Errors-To: owner-FreeBSD-net-jp@jp.FreeBSD.org
Sender: owner-FreeBSD-net-jp@jp.FreeBSD.org
X-Originator: hirano@t.kanazawa-u.ac.jp

From: Toshio Hirotsu/$BW"DE(B $BEP;VIW(B <hirotsu@t.onlab.ntt.co.jp>
> > $B$N@~$G9M$($F$_$^$9!#MW$O(B
> > 	$B!&Aw?.85(B IP
> > 	$B!&Aw?.@h(B IP 
> > 	$B!&(BURL
> > $B$/$i$$<hF@$G$-$l$P8e$G2?$H$G$b$J$k$N$G(B...
> 
> $BM_$7$$$N$,$3$l$@$1$J$N$J$i!"(Btcpdump $B$G(B -s option $B$r;H$C$F(B 80 $BHV8~$-(B
> $B$r(B 512byte $B$/$i$$$:$D5[$$>e$2$F%U%!%$%k$KCy$a$F$*$$$F2r@O$9$k$H$+!"(B
> $B$b$&$A$g$C$H??LLL\$K(B libpcap $B$r;H$C$F5[$$>e$2$J$,$i2r@O7k2L$rEG$/(B
> $B%D!<%k$r:n$k$H$+$7$?J}$,4JC1$J$s$8$c$J$$$G$7$g$&$+!)(B

$B!!(Bsnort$B$b7k9=4JC1$G!"(B

alert tcp 192.160.0.0/16 any -> any 80 (msg:"WWW get request"; content: "GET"; session: all; nocase;)

$B$N$h$&$J@_Dj%U%!%$%k$r:n$C$F$d$k$H!"(B

[**] [1:0:0] WWW get request [**]
03/18-23:59:14.095864 192.168.1.2:1960 -> 12.34.56.78:80
TCP TTL:62 TOS:0x0 ID:64776 IpLen:20 DgmLen:1415 DF
***AP*** Seq: 0xBD803D3  Ack: 0xEE54F97D  Win: 0x7D78  TcpLen: 32
TCP Options (3) => NOP NOP TS: 55158172 1638381945 

$B$N$h$&$J%m%0$rEG$$$F!"(B

/var/log/snort/192.168.1.2/SESSION:1960-80

$B$N$h$&$J%U%!%$%k$K%Q%1%C%H$NCf?H$r=q$-9~$s$G$/$l$^$9!#Cm0U$7$J$$$H%U%!(B
$B%$%k$,BgNL$K$G$-$k$N$G!"%m%0$r=87W$7$?$i>C$9$H$+$7$F$d$kI,MW$,$"$j$^$9!#(B
----
$BJ?Ln989((B@$B6bBtBg3X9)3XIt(B $B>pJs%7%9%F%`9)3X2J(B ($B5l(B $BEE5$!&>pJs9)3X2J(B)
hirano@t.kanazawa-u.ac.jp
