['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'anomaly', 'anomaly', 'http', 'fileinfo', 'http', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'http', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo']
src_ip: 172.16.0.1, src_port: 33338, dest_ip: 192.168.10.50, dest_port: 80, event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 10, flow_pkts_toclient: 3, flow_bytes_toserver: 2048, flow_bytes_toclient: 689, flow_age: 4, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 7, flow_bytes_toserver: 1282, flow_bytes_toclient: 12065, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 9, flow_pkts_toclient: 6, flow_bytes_toserver: 893, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 7, flow_bytes_toserver: 760, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 5, flow_bytes_toserver: 826, flow_bytes_toclient: 11933, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 8, flow_bytes_toserver: 848, flow_bytes_toclient: 12131, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 6, flow_pkts_toclient: 6, flow_bytes_toserver: 725, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 5, flow_bytes_toserver: 780, flow_bytes_toclient: 11933, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 5, flow_bytes_toserver: 892, flow_bytes_toclient: 11933, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 9, flow_pkts_toclient: 7, flow_bytes_toserver: 960, flow_bytes_toclient: 12065, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 6, flow_bytes_toserver: 833, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, flow_pkts_toserver: 1, flow_pkts_toclient: 0, flow_bytes_toserver: 74, flow_bytes_toclient: 0, flow_age: 0, flow_state: new, flow_reason: timeout, tcp_tcp_flags: 02, tcp_tcp_flags_ts: 02, tcp_tcp_flags_tc: 00, tcp_syn: True, tcp_state: syn_sent ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 9, flow_pkts_toclient: 6, flow_bytes_toserver: 959, flow_bytes_toclient: 12010, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 5, flow_bytes_toserver: 1244, flow_bytes_toclient: 11970, flow_age: 11, flow_state: established, flow_reason: timeout, tcp_tcp_flags: 1b, tcp_tcp_flags_ts: 1a, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_psh: True, tcp_ack: True, tcp_state: fin_wait2 ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: http, proto: TCP, tx_id: 0, http_http_port: 0, http_url: /, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12), http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 400, http_length: 301 ; event_type: fileinfo, proto: TCP, http_http_port: 0, http_url: /, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12), http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 400, http_length: 301, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 301, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?ZYA=SFXEDHGRBB, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_refer: http://engadget.search.aol.com/search?q=JOUEYKCF, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 1467 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 10 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?ESNQUJDPXD=KHY, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/LVPLSQD, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11321 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?ESNQUJDPXD=KHY, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/LVPLSQD, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11321, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11321, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?IJBI=PYC, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=RGCWR, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?IJBI=PYC, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=RGCWR, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?RPJQXOJJ=CRFGN, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US), http_http_refer: http://205.174.165.68/CPCVKAY, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 10 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?PGXVXFINH=HPSY, http_http_user_agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.3) Gecko/20090913 Firefox/3.5.3, http_http_refer: http://205.174.165.68/RVXNADRFVB, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?LIFJW=IOIV, http_http_user_agent: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51, http_http_refer: http://www.usatoday.com/search/results?q=UAWZWJ, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?YZEK=SQIQOKF, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_refer: http://engadget.search.aol.com/search?q=AFKGGSGBRL, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 10 ; pcap_cnt: 8451008, event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?KOXPLTVMK=URPPQDJ, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/GTFFPS, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11321 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?KOXPLTVMK=URPPQDJ, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/GTFFPS, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11321, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11321, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?OSAKYKIS=EANL, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=YLQFAAEZU, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11321 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?OSAKYKIS=EANL, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://www.google.com/?q=YLQFAAEZU, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11321, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11321, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?SNYWAEWMQI=IBRXEK, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/AILSCVBWMR, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8414 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?SNYWAEWMQI=IBRXEK, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_content_type: text/html, http_http_refer: http://205.174.165.68/AILSCVBWMR, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 8414, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 8414, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?UHYUY=FUKB, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=YVQCFNDY, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 10 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?UHYUY=FUKB, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=YVQCFNDY, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11310, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?FCqka8LVV=xH3rcIKYUDwDA, http_http_user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_5_1) AppleWebKit/535.24 (KHTML, like Gecko) Version/6.0.3 Safari/537.10, http_http_content_type: text/html, http_http_refer: http://www.yandex.com/H4wJXaS1?ma5=yP0Xfqm8nDjVa2v6nI&8JPAf=bNx&rUuCXWoIX=CPsMAdVv3FW4NeO&L4flWb=m3vVLuiJYfjidJ&p1G=CVdSoOblqAq2pOOUQyHJ&AljJTK=ua5aBAwaCFjsHaf&TFUWnMiVRT=LGks1&biUy1d3D1=CgsJ2QQrkusIkF, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1137 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?FCqka8LVV=xH3rcIKYUDwDA, http_http_user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_5_1) AppleWebKit/535.24 (KHTML, like Gecko) Version/6.0.3 Safari/537.10, http_http_content_type: text/html, http_http_refer: http://www.yandex.com/H4wJXaS1?ma5=yP0Xfqm8nDjVa2v6nI&8JPAf=bNx&rUuCXWoIX=CPsMAdVv3FW4NeO&L4flWb=m3vVLuiJYfjidJ&p1G=CVdSoOblqAq2pOOUQyHJ&AljJTK=ua5aBAwaCFjsHaf&TFUWnMiVRT=LGks1&biUy1d3D1=CgsJ2QQrkusIkF, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1137, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1137, fileinfo_tx_id: 0
The network event indicates a DoS Slowloris. DoS Slowloris attacks involve sending partial HTTP requests to the target server, keeping connections open as long as possible. Typically, the logs show multiple long-lived connections with minimal data exchange, aiming to exhaust the target server's resources by maintaining numerous open connections. Additionally, the logs contain multiple `anomaly` events indicating `UNABLE_TO_MATCH_RESPONSE_TO_REQUEST`, which is consistent with incomplete HTTP requests. These characteristics align with the behavior of DoS Slowloris attacks, which aim to overwhelm the server by keeping numerous connections open with incomplete requests.
classification: Attack
justification: The network event indicates a DoS Slowloris. DoS Slowloris attacks involve sending partial HTTP requests to the target server, keeping connections open as long as possible. Typically, the logs show multiple long-lived connections with minimal data exchange, aiming to exhaust the target server's resources by maintaining numerous open connections. Additionally, the logs contain multiple `anomaly` events indicating `UNABLE_TO_MATCH_RESPONSE_TO_REQUEST`, which is consistent with incomplete HTTP requests. These characteristics align with the behavior of DoS Slowloris attacks, which aim to overwhelm the server by keeping numerous connections open with incomplete requests.