['flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'flow', 'anomaly', 'anomaly', 'http', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'http', 'http', 'http', 'http', 'http', 'http', 'http', 'fileinfo', 'http', 'http', 'fileinfo']
src_ip: 172.16.0.1, src_port: 59466, dest_ip: 192.168.10.50, dest_port: 80, event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 16, flow_pkts_toclient: 3, flow_bytes_toserver: 3621, flow_bytes_toclient: 208, flow_age: 105, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1a, tcp_tcp_flags_tc: 16, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 6, flow_bytes_toserver: 911, flow_bytes_toclient: 11999, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 5, flow_bytes_toserver: 838, flow_bytes_toclient: 11933, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 5, flow_bytes_toserver: 1598, flow_bytes_toclient: 11933, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 885, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 6, flow_bytes_toserver: 1142, flow_bytes_toclient: 11999, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 9, flow_pkts_toclient: 5, flow_bytes_toserver: 909, flow_bytes_toclient: 11933, flow_age: 1, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1e, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 12, tcp_syn: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 9, flow_pkts_toclient: 6, flow_bytes_toserver: 958, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 7, flow_pkts_toclient: 6, flow_bytes_toserver: 834, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 6, flow_bytes_toserver: 866, flow_bytes_toclient: 11999, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 5, flow_bytes_toserver: 861, flow_bytes_toclient: 11933, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 8, flow_pkts_toclient: 5, flow_bytes_toserver: 852, flow_bytes_toclient: 11933, flow_age: 0, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1e, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 14, flow_pkts_toclient: 6, flow_bytes_toserver: 2740, flow_bytes_toclient: 12036, flow_age: 18, flow_state: established, flow_reason: timeout, tcp_tcp_flags: 1b, tcp_tcp_flags_ts: 1a, tcp_tcp_flags_tc: 13, tcp_syn: True, tcp_fin: True, tcp_psh: True, tcp_ack: True, tcp_state: fin_wait2 ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: anomaly, proto: TCP, tx_id: 1, anomaly_app_proto: http, anomaly_type: applayer, anomaly_event: UNABLE_TO_MATCH_RESPONSE_TO_REQUEST, anomaly_layer: proto_parser ; event_type: http, proto: TCP, tx_id: 0, http_http_port: 0, http_url: /, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.503l3; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; MSOffice 12), http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?DAUD=NPZHOFQM, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=AUUDUOQXMX, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 10 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?DAUD=NPZHOFQM, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_content_type: text/html, http_http_refer: http://www.usatoday.com/search/results?q=AUUDUOQXMX, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11310, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?QTAZVPZ=GUSDCFS, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=XWJRQL, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?QTAZVPZ=GUSDCFS, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US), http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=XWJRQL, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1174, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1174, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?JPM=XRIJ, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; InfoPath.2), http_http_refer: http://www.google.com/?q=ERINFWGYBJ, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 10 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?EUOTBC=BMBDFYIJR, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729), http_http_refer: http://www.usatoday.com/search/results?q=FJVOMWA, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?IEPC=JSWUYRIYH, http_http_user_agent: Mozilla/4.0 (compatible; MSIE 6.1; Windows XP), http_http_refer: http://engadget.search.aol.com/search?q=FUUZCXQ, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?QGHZKPJHH=DQRMUCSBC, http_http_user_agent: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51, http_http_refer: http://205.174.165.68/TJNTDVHR, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?UMBYZMX=GKBZYRHYE, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.1) Gecko/20090718 Firefox/3.5.1, http_http_refer: http://engadget.search.aol.com/search?q=OXOLHVDCH, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 1453 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?UJIYRAZYTS=OECDDFSD, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 (.NET CLR 3.5.30729), http_http_refer: http://www.usatoday.com/search/results?q=ZBBWBVVB, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?HNCAQM=PEB, http_http_user_agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.1) Gecko/20090718 Firefox/3.5.1, http_http_refer: http://engadget.search.aol.com/search?q=KUMJQPRM, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?KMPMNOOBS=IKB, http_http_user_agent: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51, http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=IZACAAQF, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310 ; event_type: http, proto: TCP, tx_id: 1, http_http_port: 0, http_url: /libhtp::request_uri_not_seen, http_length: 10 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?KMPMNOOBS=IKB, http_http_user_agent: Opera/9.80 (Windows NT 5.2; U; ru) Presto/2.5.22 Version/10.51, http_http_content_type: text/html, http_http_refer: http://engadget.search.aol.com/search?q=IZACAAQF, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 11310, app_proto: http, fileinfo_filename: /, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 11310, fileinfo_tx_id: 0 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?TGTKAM=BFI, http_http_user_agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.3) Gecko/20090913 Firefox/3.5.3, http_http_refer: http://205.174.165.68/GSBVWA, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 10 ; event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /?l6Jw4tL=O7xU, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 6.0; Windows NT 5.1; .NET CLR 1.3.18254; Win64; x64), http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1137 ; event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /?l6Jw4tL=O7xU, http_http_user_agent: Mozilla/5.0 (Windows; U; MSIE 6.0; Windows NT 5.1; .NET CLR 1.3.18254; Win64; x64), http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 1137, app_proto: http, fileinfo_filename: /, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1137, fileinfo_tx_id: 0
The network event indicates a DoS Slowloris. DoS Slowloris attacks involve sending partial HTTP requests to the target server, keeping connections open as long as possible. Typically, the logs show multiple long-lived connections with minimal data exchange, aiming to exhaust the target server's resources by maintaining numerous open connections. Additionally, the logs contain multiple `anomaly` events indicating `UNABLE_TO_MATCH_RESPONSE_TO_REQUEST`, which is consistent with incomplete HTTP requests. These characteristics align with the behavior of DoS Slowloris attacks, which aim to overwhelm the server by keeping numerous connections open with incomplete requests.
classification: Attack
justification: The network event indicates a DoS Slowloris. DoS Slowloris attacks involve sending partial HTTP requests to the target server, keeping connections open as long as possible. Typically, the logs show multiple long-lived connections with minimal data exchange, aiming to exhaust the target server's resources by maintaining numerous open connections. Additionally, the logs contain multiple `anomaly` events indicating `UNABLE_TO_MATCH_RESPONSE_TO_REQUEST`, which is consistent with incomplete HTTP requests. These characteristics align with the behavior of DoS Slowloris attacks, which aim to overwhelm the server by keeping numerous connections open with incomplete requests.