RE: IDS: reading signatures?

[Kim Robert Blix <kim@nhi.no>]

FAQ: See http://www.ticm.com/kb/faq/idsfaq.html
IDS: See http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems... email questions to ids-owner@uow.edu.au
NOTE: Remove this section from reply msgs otherwise the msg will bounce.
SPAM: DO NOT send unsolicted mail to this list.
USUBSCRIBE: email "unsubscribe ids" to majordomo@uow.edu.au
---------------------------------------------------------------------------
---

> the end of it.  And it was fast, so it is obviously a script.  Here is a
> better example:
> 
> 14:18:36.148999 x.x.x.x.9999 > x.x.x.0.53: 1205+ (45)
> 14:18:36.188602 x.x.x.x.9999 > x.x.x.0.53: 1205+ (45)
> 14:18:36.756601 x.x.x.x.9999 > x.x.x.255.53: 1205+ (45)
> 14:18:36.803255 x.x.x.x.9999 > x.x.x.255.53: 1205+ (45)

[snip]

2 things come to mind:

  covert data sent to a compromized service. not likly since there are no
response packets comming from your side.
 
  dns scanning, which seems more likly given that broadcast adresses are
used. 

if I where you I would get some more information though. I assue the
x.x.x.244.53 packets are udp, but are they all? Its fairly easy to
recognize a scan if you log tcp packets, flags and such give tell-tale
signs (not to mention the fact that tcp.id is 31337 :-P). Sniff the
packets to see what they contain.  

in short, you need to do some more digging.

k