NSP Attacker Log direction error_2

[abel_pan]

Hi sir 

My network security manager attack log  was error .

For example before direction is  inbound attack log bot change to  outbound new. 

So how can i fax this bug.

Abel pan 

[fkazi04]

Hi @abel_pan 

I understand you are referring to the BOT traffic detected showing reversed IP.

If that's the case, then it is by design. 

let me explain you:

The host sends an HTTP request to the C&C server. The packet from the host to the C&C server (HTTP server) will list the host as the source (src) IP and the C&C server (HTTP server) as the destination (dest) IP. When an alert is raised for this C&C communication, the attacker src is the C&C server IP and the attacked host is the attack destination. 

for more details, I would suggest you to follow:

https://kc.mcafee.com/corporate/index?page=content&id=KB85202

[abel_pan]

Sorry that was my foul .

Not BOT traffic .

let me restate my question .

under normal circumstance A address attack to  B address .that is inbound 

but same log A address attack to B address  change into outbound now.

This change is wrong.

Abel pan 

[fkazi04 · Accepted solution]

Hi @abel_pan 

Now I understand 🙂

Direction of the traffic is defined from the direction of the interface i.e. inbound/outbound. Unless there are any changes in traffic direction or configuration, it quite  unlikely the direction will be updated.

Follow below steps to confirm if the direction is correct or not:

1. From any PC which is inspected by the Sensor, access http://abc.com/../../../root.exe [this will not open any website but will trigger an alert]

2. In the NSM, check attack log and direction must be outbound. If it is not we must investigate further.