Since May 26 we have received more than 1800 broken packets from Ips corresponding to AOL servers. AOL characterizes this as normal web traffic and my faulty snort rules despite the fact that the reserved flag is set. AOL has been alternately patronizing and mute on the subject. I am including 31 instances of these events that are from AOL servers that are not from port 80. Output is from snort prettied up some.
Fields are comma delimited.
Post 36385 does not match any known port on my ports listing. I figure that since nmap has been ported to NT we will see more scans coming down the wire with strange options and flags. Still, it probably won't be long before someone fixes the NDIS interface elements of the code to allow it to work with RAS devices. 192.x.x.x is the internal address of our extranet server. This was discussed just recently here at GIAC, but I don't understand why the PIX attempts to do a translation of these non-routable IPs, unless it is confused into thinking that this address is actually local.