Comments on: Interesting..No? http://blog.hazrulnz.net/245/interestingno.html I dunno why on earth I have this blog. Wed, 07 Jan 2009 08:20:45 +0000 http://wordpress.org/?v= hourly 1 By: The_GigCo http://blog.hazrulnz.net/245/interestingno.html/comment-page-1#comment-5320 The_GigCo Sun, 13 May 2007 06:40:41 +0000 http://blog.hazrulnz.net/245/interestingno.html#comment-5320 Hehehehe.. Handshake[^p0k0l]* /\ack-syn-ack/\syn/\rst.. 192.168.2.102:31300/LCE server 192.168.2.11:3452/thunder_client[LAN] connected/established.. Correlations in progress.. i : LCE u : LAN [Location local Topology] * u matched i capture u * ** if not i keep listen/establised ** *** i correlate u matched n u reset *** **** i'm immortal **** u're my servant **** 192.168.2.41 belongs to one of the SSA in here. If u happen to see any 514/UDP establised, he should have configured syslogd to gather n logging to SC3 as well.. hehehe.. hope it helps Hehehehe..
Handshake[^p0k0l]* /\ack-syn-ack/\syn/\rst..

192.168.2.102:31300/LCE server
192.168.2.11:3452/thunder_client[LAN]
connected/established..

Correlations in progress..
i : LCE
u : LAN
[Location local Topology]

* u matched i capture u *
** if not i keep listen/establised **
*** i correlate u matched n u reset ***
**** i’m immortal **** u’re my servant ****

192.168.2.41 belongs to one of the SSA in here.
If u happen to see any 514/UDP establised, he should have configured syslogd to gather n logging to SC3 as well..

hehehe.. hope it helps

]]>