cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
abel_pan
Level 9
Report Inappropriate Content
Message 1 of 4

NSP Attacker Log direction error_2

Jump to solution

Hi sir 

My network security manager attack log  was error .

For example before direction is  inbound attack log bot change to  outbound new. 

So how can i fax this bug.

Abel pan 

1 Solution

Accepted Solutions
fkazi04
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: NSP Attacker Log direction error_2

Jump to solution

Hi @abel_pan 

Now I understand 🙂

Direction of the traffic is defined from the direction of the interface i.e. inbound/outbound. Unless there are any changes in traffic direction or configuration, it quite  unlikely the direction will be updated.

Follow below steps to confirm if the direction is correct or not:

1. From any PC which is inspected by the Sensor, access http://abc.com/../../../root.exe [this will not open any website but will trigger an alert]

2. In the NSM, check attack log and direction must be outbound. If it is not we must investigate further.

 

Regards,
Faizan

Was my reply helpful?
If you find this post useful, please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

View solution in original post

3 Replies
fkazi04
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: NSP Attacker Log direction error_2

Jump to solution

Hi @abel_pan 

I understand you are referring to the BOT traffic detected showing reversed IP.

If that's the case, then it is by design. 

let me explain you:

The host sends an HTTP request to the C&C server. The packet from the host to the C&C server (HTTP server) will list the host as the source (src) IP and the C&C server (HTTP server) as the destination (dest) IP. When an alert is raised for this C&C communication, the attacker src is the C&C server IP and the attacked host is the attack destination. 

for more details, I would suggest you to follow:

https://kc.mcafee.com/corporate/index?page=content&id=KB85202

 

Regards,
Faizan

Was my reply helpful?
If you find this post useful, please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
abel_pan
Level 9
Report Inappropriate Content
Message 3 of 4

Re: NSP Attacker Log direction error_2

Jump to solution

Sorry that was my foul .

Not BOT traffic .

let me restate my question .

under normal circumstance A address attack to  B address .that is inbound 

but same log A address attack to B address  change into outbound now.

This change is wrong.

Abel pan 

fkazi04
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: NSP Attacker Log direction error_2

Jump to solution

Hi @abel_pan 

Now I understand 🙂

Direction of the traffic is defined from the direction of the interface i.e. inbound/outbound. Unless there are any changes in traffic direction or configuration, it quite  unlikely the direction will be updated.

Follow below steps to confirm if the direction is correct or not:

1. From any PC which is inspected by the Sensor, access http://abc.com/../../../root.exe [this will not open any website but will trigger an alert]

2. In the NSM, check attack log and direction must be outbound. If it is not we must investigate further.

 

Regards,
Faizan

Was my reply helpful?
If you find this post useful, please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community