first time snort

[nmeyers at javalinux.net]

On Fri, Sep 10, 2004 at 07:10:21AM -0700, Eric wrote:
> I just turned on snort for the first time.  It's so
> cool...  Within fifteen minutes I got something to
> see.
> 
> Log
> Date:	09/10 04:46:01 	Name:	WEB-IIS ISAPI .ida attempt
> Priority:	1 	Type:	Web Application Attack...
> 
> New stuff to check out!  But why would someone do
> that?  I'm obviously not using windows...  Is this
> automated?  And do you guys see this stuff constantly?

All the time. These worms aren't discriminating - you're listening at
port 80, so you're fair game.

Nathan