To whom it may concern,

 

Our sensors indicate possible penetration originating from a device on 
your network.

 

EVENT_TIME = Thu Sep 11 14:11:17 PDT 2003

INCIDENT_START = Thu Sep 11 14:11:17 PDT 2003

DEVICE = DMZ_6506

LOCALIFACE = 2/11

INCIDENTFAMILY = availability

INCIDENTTYPE = RCRS/COUNTER_UNACKED_SYNS_HIGH

DESC = SYN flood

PRIORITY = Critical

ALERT_NUMBER = 1

SRC_IP_LIST = 158.61.101.8:21472,158.61.59.195:17665,*128.109.131.47:23630*

DST_IP_LIST = 172.30.12.13:80

FLOWCOOKIE = 
TCP%COUNTER,SPOOF,SYNS%158.61.59.195:17665/172.30.12.13:80#3968,*128.109.131.47:23630/172.30.12.13:80#0*,158.61.101.8:21472/172.30.12.13:80#0

 

We trust you will take appropriate measures to rectify the situation.

 

Thank you in advance for your cooperation.

County of Riverside Network Security Team