Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 0.000000] Linux version 3.10.20 (daniel@Ayoub) (gcc version 4.7.0 (Cavium Inc. Version: SDK_3_1_0_p2 build 34) ) #165 SMP Mon May 18 23:41:17 PDT 2015 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 0.000000] CVMSEG size: 2 cache lines (256 bytes) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Cavium Inc. SDK-3.1 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] bootconsole [early0] enabled Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] CPU revision is: 000d9602 (Cavium Octeon III) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] FPU revision is: 00739600 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] Checking for the multiply/shift bug... no. Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] Checking for the daddiu bug... no. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Determined physical RAM map: Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] memory: 000000000c800000 @ 0000000002500000 (usable) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] memory: 0000000000c00000 @ 000000000f200000 (usable) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] memory: 000000002f000000 @ 0000000020000000 (usable) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] memory: 0000000000830000 @ 0000000000100000 (usable) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] memory: 0000000001a00000 @ 0000000000930000 (usable after init) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Wasting 896 bytes for tracking 16 unused pages Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Initrd not found or empty - disabling initrd Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Using passed Device Tree <8000000000080000>. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] software IO TLB [mem 0x02670000-0x026b0000] (0MB) mapped at [8000000002670000-80000000026affff] Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] Zone ranges: Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] DMA32 [mem 0x00100000-0xefffffff] Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] Normal empty Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] Movable zone start for each node Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] Early memory node ranges Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] node 0: [mem 0x00100000-0x0232ffff] Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] node 0: [mem 0x02500000-0x0ecfffff] Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] node 0: [mem 0x0f200000-0x0fdfffff] Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] node 0: [mem 0x20000000-0x4effffff] Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] On node 0 totalpages: 15971 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] DMA32 zone: 14 pages used for memmap Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] DMA32 zone: 0 pages reserved Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] DMA32 zone: 15971 pages, LIFO batch:1 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Cavium Hotplug: Available coremask 0x0 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 0.000000] Primary instruction cache 78kB, virtually tagged, 39 way, 16 sets, linesize 128 bytes. Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 0.000000] Primary data cache 32kB, 32-way, 8 sets, linesize 128 bytes. Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 0.000000] Secondary unified cache 512kB, 4-way, 1024 sets, linesize 128 bytes. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] PERCPU: Embedded 1 pages/cpu @8000000002710000 s12544 r8192 d44800 u65536 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] pcpu-alloc: s12544 r8192 d44800 u65536 alloc=1*65536 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] pcpu-alloc: [0] 0 [0] 1 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 0.000000] Built 1 zonelists in Zone order, mobility grouping off. Total pages: 15957 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 0.000000] Kernel command line: bootoctlinux 0x20000000 numcores=2 serial#=752011191521-36287 console=ttyS0,115200 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] PID hash table entries: 4096 (order: -1, 32768 bytes) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Dentry cache hash table entries: 131072 (order: 4, 1048576 bytes) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Inode-cache hash table entries: 65536 (order: 3, 524288 bytes) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Memory: 983296k/1022144k available (5825k kernel code, 38848k reserved, 2536k data, 26624k init, 0k highmem) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] Hierarchical RCU implementation. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] RCU restricting CPUs from NR_CPUS=32 to nr_cpu_ids=2. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] NR_IRQS:512 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] CIB interrupt controller probed: 800107000000e000 23 bits Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] CIB interrupt controller probed: 800107000000e200 12 bits Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] CIB interrupt controller probed: 800107000000e400 6 bits Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] CIB interrupt controller probed: 800107000000ec00 15 bits Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] CIB interrupt controller probed: 800107000000e600 4 bits Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] CIB interrupt controller probed: 800107000000e800 11 bits Mon Mar 28 12:20:01 2016 kern.info kernel: [ 0.000000] CIB interrupt controller probed: 800107000000e900 11 bits Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.546890] Calibrating delay loop (skipped) preset value.. 2000.00 BogoMIPS (lpj=10000000) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.555103] pid_max: default: 32768 minimum: 501 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.559819] Security Framework initialized Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.563836] Mount-cache hash table entries: 4096 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 22.570089] Checking for the daddi bug... no. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.570879] SMP: Booting CPU01 (CoreId 1)... Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.575081] CPU revision is: 000d9602 (Cavium Octeon III) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.575085] FPU revision is: 00739600 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.575267] Cpu 1 online Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.586682] Brought up 2 CPUs Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.589627] Cavium Hotplug: Available coremask 0x0 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 22.596615] NET: Registered protocol family 16 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 22.602029] Installing handlers for error tree at: ffffffff808be430 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 22.619548] PCIe: Initializing port 0 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 24.682084] PCIe: Link timeout on port 0, probably the slot is empty Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 24.682090] PCIe: Initializing port 1 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 24.685586] PCIe: Port 1 not in PCIe mode, skipping Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 24.685591] PCIe: Initializing port 2 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 24.689233] PCIe: Port 2 not in PCIe mode, skipping Mon Mar 28 12:20:01 2016 kern.warn kernel: [ 24.695601] [sched_delayed] sched: RT throttling activated Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.708919] bio: create slab at 0 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.713341] vgaarb: loaded Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 24.716272] SCSI subsystem initialized Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 24.720122] libata version 3.00 loaded. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.720538] usbcore: registered new interface driver usbfs Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.725971] usbcore: registered new interface driver hub Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.731267] usbcore: registered new device driver usb Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.736419] pps_core: LinuxPPS API ver. 1 registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.741216] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.750440] PTP clock support registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.754318] EDAC MC: Ver: 3.0.0 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.757997] PCI host bridge to bus 0000:00 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.761953] pci_bus 0000:00: root bus resource [mem 0x1000000000000] Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.768276] pci_bus 0000:00: root bus resource [io 0x0000] Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.773844] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff] Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 24.781771] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.782718] Switching to clocksource OCTEON_CVMCOUNT Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.788989] NET: Registered protocol family 2 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.793632] TCP established hash table entries: 8192 (order: 1, 131072 bytes) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.800749] TCP bind hash table entries: 8192 (order: 1, 131072 bytes) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.807238] TCP: Hash tables configured (established 8192 bind 8192) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.813507] TCP: reno registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.816688] UDP hash table entries: 2048 (order: 0, 65536 bytes) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.822775] UDP-Lite hash table entries: 2048 (order: 0, 65536 bytes) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 24.829432] NET: Registered protocol family 1 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 24.833637] PCI: CLS 0 bytes, default 128 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 26.422117] octeon_pci_console: Console not created. Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 26.426919] /proc/octeon_perf: Octeon performance counter interface loaded Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.435779] HugeTLB registered 512 MB page size, pre-allocated 0 pages Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 26.443505] sys_fw_version: 0.1.17 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 26.443518] sys_revision: 21 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.443866] squashfs: version 4.0 (2009/01/31) Phillip Lougher Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.449801] NTFS driver 2.1.30 [Flags: R/W]. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.453930] jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.460063] msgmni has been set to 1920 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 26.464804] Key type asymmetric registered Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 26.468790] Asymmetric key parser 'x509' registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.473614] io scheduler noop registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.477513] io scheduler deadline registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.481807] io scheduler cfq registered (default) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.486719] octeon_gpio 1070000000800.gpio-controller: OCTEON GPIO Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.542523] Serial: 8250/16550 driver, 6 ports, IRQ sharing disabled Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.552174] 1180000000800.serial: ttyS0 at MMIO 0x1180000000800 (irq = 34) is a OCTEON Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.559965] console [ttyS0] enabled, bootconsole disabled Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.583503] 1180000000c00.serial: ttyS1 at MMIO 0x1180000000c00 (irq = 35) is a OCTEON Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.605596] brd: module loaded Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.624090] loop: module loaded Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 26.640946] slram: not enough parameters. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.665320] IMQ driver loaded successfully. (numdevs = 16, numqueues = 1) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.684410] Hooking IMQ after NAT on PREROUTING. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.701398] Hooking IMQ before NAT on POSTROUTING. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.720516] libphy: mdio-octeon: probed Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.737745] mdio-octeon 1180000001800.mdio: Version 1.0 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.755238] spi_ks8995: Micrel KS8995 Ethernet switch SPI driver version 0.1.1 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.775136] e1000e: Intel(R) PRO/1000 Network Driver - 2.3.2-k Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.793123] e1000e: Copyright(c) 1999 - 2013 Intel Corporation. Mon Mar 28 12:20:01 2016 kern.err kernel: [ 26.811411] octeon-pow-ethernet ERROR: You must specify a broadcast group mask. Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 26.830897] octeon-ethernet 2.0 Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 26.847784] Interface 0 has 4 ports (QSGMII) Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 26.847864] Interface 1 has 4 ports (QSGMII) Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 26.847871] Interface 2 has 4 ports (NPI) Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 26.847886] Interface 3 has 4 ports (LOOP) Mon Mar 28 12:20:01 2016 kern.debug kernel: [ 26.847902] Interface 4 has 1 ports (AGL) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.855840] usbcore: registered new interface driver cdc_ether Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.873919] usbcore: registered new interface driver plusb Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.891653] usbcore: registered new interface driver sierra_net Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.910362] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.929183] ehci-pci: EHCI PCI platform driver Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.945862] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.964796] usbcore: registered new interface driver usb-storage Mon Mar 28 12:20:01 2016 kern.info kernel: [ 26.983143] usbcore: registered new interface driver usbserial Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.001202] usbcore: registered new interface driver usbserial_generic Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.019964] usbserial: USB Serial support registered for generic Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.038198] usbcore: registered new interface driver sierra Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.055985] usbserial: USB Serial support registered for Sierra USB modem Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.075183] i2c /dev entries driver Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.091197] i2c-octeon 1180000001000.i2c: version 2.5 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.109172] octeon_wdt: Initial granularity 5 Sec Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.126269] EDAC DEVICE0: Giving out device to module 'octeon-cpu' controller 'cache': DEV 'octeon_pc_edac' (INTERRUPT) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.149370] EDAC DEVICE1: Giving out device to module 'octeon-l2c' controller 'octeon_l2c_err': DEV 'octeon_l2c_edac' (POLLED) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 27.173022] octeon_lmc_edac octeon_lmc_edac.0: Disabled (ECC not enabled) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.797758] Netfilter messages via NETLINK v0.30. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.814603] nfnl_acct: registering with nfnetlink. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.831563] nf_conntrack version 0.5.0 (7682 buckets, 30728 max) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.850002] ctnetlink v0.93: registering with nfnetlink. Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.867835] xt_time: kernel timezone is -0000 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 29.884329] ip_set: protocol 6 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.899629] ipip: IPv4 over IPv4 tunneling driver Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.916974] gre: GRE over IPv4 demultiplexor driver Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.933988] ip_gre: GRE over IPv4 tunneling driver Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.952207] ip_tables: (C) 2000-2006 Netfilter Core Team Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.969848] ipt_CLUSTERIP: ClusterIP Version 0.8 loaded successfully Mon Mar 28 12:20:01 2016 kern.info kernel: [ 29.988383] arp_tables: (C) 2002 David S. Miller Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.005179] TCP: cubic registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.020620] Initializing XFRM netlink socket Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.037065] NET: Registered protocol family 10 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.056869] mip6: Mobile IPv6 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.072014] ip6_tables: (C) 2000-2006 Netfilter Core Team Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.089829] sit: IPv6 over IPv4 tunneling driver Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.107988] ip6_gre: GRE over IPv6 tunneling driver Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.125635] NET: Registered protocol family 17 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.142246] NET: Registered protocol family 15 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 30.158900] Bridge firewalling registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.175052] Ebtables v2.0 registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.237586] 8021q: 802.1Q VLAN Support v1.8 Mon Mar 28 12:20:01 2016 kern.notice kernel: [ 30.253954] Key type dns_resolver registered Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.270490] L2 lock: TLB refill 256 bytes Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.286624] L2 lock: General exception 128 bytes Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.303360] L2 lock: low-level interrupt 128 bytes Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.320273] L2 lock: interrupt 640 bytes Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.336322] L2 lock: memcpy 1152 bytes Mon Mar 28 12:20:01 2016 kern.err kernel: [ 30.354264] drivers/rtc/hctosys.c: unable to open rtc device (rtc0) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 30.379002] Freeing unused kernel memory: 26624K (ffffffff80930000 - ffffffff82330000) Mon Mar 28 12:20:01 2016 kern.info kernel: [ 46.831204] mmc1: BKOPS_EN bit is not set Mon Mar 28 12:20:01 2016 kern.info kernel: [ 46.851906] mmc1: new high speed DDR MMC card at address 0001 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 46.870376] mmcblk0: mmc1:0001 P1XXXX 3.60 GiB Mon Mar 28 12:20:01 2016 kern.info kernel: [ 46.887359] mmcblk0boot0: mmc1:0001 P1XXXX partition 1 2.00 MiB Mon Mar 28 12:20:01 2016 kern.info kernel: [ 46.905729] mmcblk0boot1: mmc1:0001 P1XXXX partition 2 2.00 MiB Mon Mar 28 12:20:01 2016 kern.info kernel: [ 46.924097] mmcblk0rpmb: mmc1:0001 P1XXXX partition 3 128 KiB Mon Mar 28 12:20:01 2016 kern.info kernel: [ 46.946030] mmcblk0: p1 p2 p3 p4 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 46.966990] mmcblk0boot1: unknown partition table Mon Mar 28 12:20:01 2016 kern.info kernel: [ 46.988507] mmcblk0boot0: unknown partition table Mon Mar 28 12:20:01 2016 kern.info kernel: [ 47.835988] kjournald starting. Commit interval 5 seconds Mon Mar 28 12:20:01 2016 kern.info kernel: [ 47.854658] EXT3-fs (mmcblk0p4): using internal journal Mon Mar 28 12:20:01 2016 kern.info kernel: [ 47.873446] EXT3-fs (mmcblk0p4): recovery complete Mon Mar 28 12:20:01 2016 kern.info kernel: [ 47.890509] EXT3-fs (mmcblk0p4): mounted filesystem with writeback data mode Mon Mar 28 12:20:01 2016 user.err kernel: [ 48.130646] init: failed to symlink /tmp -> /var Mon Mar 28 12:20:01 2016 user.info kernel: [ 48.147703] init: Console is alive Mon Mar 28 12:20:01 2016 user.info kernel: [ 48.163582] init: - watchdog - Mon Mar 28 12:20:01 2016 user.info kernel: [ 49.179728] init: - preinit - Mon Mar 28 12:20:01 2016 user.notice kernel: [ 52.379161] mount_root: mounting /dev/root Mon Mar 28 12:20:01 2016 user.info kernel: [ 52.396118] mount_root: loading kmods from internal overlay Mon Mar 28 12:20:01 2016 user.info kernel: [ 52.525841] block: attempting to load /etc/config/fstab Mon Mar 28 12:20:01 2016 user.info kernel: [ 52.545479] block: extroot: not configured Mon Mar 28 12:20:01 2016 user.info kernel: [ 52.566457] procd: - early - Mon Mar 28 12:20:01 2016 user.info kernel: [ 52.581798] procd: - watchdog - Mon Mar 28 12:20:01 2016 user.info kernel: [ 53.304244] procd: - ubus - Mon Mar 28 12:20:01 2016 user.info kernel: [ 54.319447] procd: - init - Mon Mar 28 12:20:01 2016 kern.info kernel: [ 56.125445] NET: Registered protocol family 38 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 56.151172] tun: Universal TUN/TAP device driver, 1.6 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 56.168578] tun: (C) 1999-2004 Max Krasnyansky Mon Mar 28 12:20:01 2016 kern.info kernel: [ 56.202240] u32 classifier Mon Mar 28 12:20:01 2016 kern.info kernel: [ 56.217119] input device check on Mon Mar 28 12:20:01 2016 kern.info kernel: [ 56.232904] Actions configured Mon Mar 28 12:20:01 2016 kern.info kernel: [ 56.249489] Mirror/redirect action on Mon Mar 28 12:20:01 2016 kern.info kernel: [ 56.273794] PPP generic driver version 2.4.2 Mon Mar 28 12:20:01 2016 kern.info kernel: [ 56.291125] NET: Registered protocol family 24 Mon Mar 28 12:20:02 2016 user.emerg procd: this file has been obseleted. please call "/sbin/block mount" directly Mon Mar 28 12:20:02 2016 daemon.warn netifd: You have delegated IPv6-prefixes but haven't assigned them to any interface. Did you forget to set option ip6assign on your lan-interfaces? Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'lan' is enabled Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'blockdomain' is enabled Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'blockdomain' is setting up now Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'blockdomain' is now up Mon Mar 28 12:20:02 2016 kern.debug kernel: [ 58.301022] SGMII0: Port 1 link timeout Mon Mar 28 12:20:02 2016 kern.notice kernel: [ 58.301273] eth1: 1000 Mbps Full duplex, port 1 Mon Mar 28 12:20:02 2016 kern.info kernel: [ 58.301349] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready Mon Mar 28 12:20:02 2016 kern.info kernel: [ 58.302224] device eth1 entered promiscuous mode Mon Mar 28 12:20:02 2016 kern.info kernel: [ 58.304308] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'loopback' is enabled Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'loopback' is setting up now Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'loopback' is now up Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'wan' is enabled Mon Mar 28 12:20:02 2016 daemon.err block: /dev/mmcblk0p4 is already mounted Mon Mar 28 12:20:02 2016 kern.notice kernel: [ 58.331684] eth0: 1000 Mbps Full duplex, port 0 Mon Mar 28 12:20:02 2016 kern.info kernel: [ 58.331770] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready Mon Mar 28 12:20:02 2016 kern.notice kernel: [ 58.353167] eth2: 1000 Mbps Full duplex, port 2 Mon Mar 28 12:20:02 2016 kern.info kernel: [ 58.353306] IPv6: ADDRCONF(NETDEV_UP): eth2: link is not ready Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'wan6' is enabled Mon Mar 28 12:20:02 2016 daemon.notice netifd: Network device 'lo' link is up Mon Mar 28 12:20:02 2016 daemon.notice netifd: Interface 'loopback' has link connectivity Mon Mar 28 12:20:02 2016 cron.info crond[3192]: crond (busybox 1.23.2) started, log level 5 Mon Mar 28 12:20:02 2016 user.emerg procd: interface lan has no physdev or physdev has no suitable ip Mon Mar 28 12:20:02 2016 daemon.info dnsmasq[3307]: started, version 2.73rc7 cachesize 150 Mon Mar 28 12:20:02 2016 daemon.info dnsmasq[3307]: compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-DNSSEC loop-detect inotify Mon Mar 28 12:20:02 2016 daemon.info dnsmasq[3307]: DNS service limited to local subnets Mon Mar 28 12:20:02 2016 daemon.info dnsmasq[3307]: using local addresses only for domain lan Mon Mar 28 12:20:02 2016 daemon.warn dnsmasq[3307]: no servers found in /tmp/resolv.conf.auto, will retry Mon Mar 28 12:20:02 2016 daemon.info dnsmasq[3307]: read /etc/hosts - 1 addresses Mon Mar 28 12:20:03 2016 daemon.notice netifd: Network device 'eth1' link is up Mon Mar 28 12:20:03 2016 daemon.notice netifd: Bridge 'br-lan' link is up Mon Mar 28 12:20:03 2016 daemon.notice netifd: Interface 'lan' has link connectivity Mon Mar 28 12:20:03 2016 daemon.notice netifd: Interface 'lan' is setting up now Mon Mar 28 12:20:03 2016 daemon.notice netifd: Interface 'blockdomain' has link connectivity Mon Mar 28 12:20:03 2016 kern.info kernel: [ 59.277909] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready Mon Mar 28 12:20:03 2016 kern.info kernel: [ 59.277970] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:03 2016 kern.info kernel: [ 59.277993] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:03 2016 kern.info kernel: [ 59.278043] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready Mon Mar 28 12:20:03 2016 daemon.notice netifd: Network device 'eth0' link is up Mon Mar 28 12:20:03 2016 daemon.notice netifd: Interface 'wan' has link connectivity Mon Mar 28 12:20:03 2016 daemon.notice netifd: Interface 'wan' is setting up now Mon Mar 28 12:20:03 2016 daemon.notice netifd: Interface 'wan' is now up Mon Mar 28 12:20:03 2016 kern.info kernel: [ 59.307828] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready Mon Mar 28 12:20:03 2016 daemon.notice netifd: lan (3452): udhcpc (v1.23.2) started Mon Mar 28 12:20:03 2016 daemon.notice netifd: Network device 'eth2' link is up Mon Mar 28 12:20:03 2016 daemon.notice netifd: Interface 'wan6' has link connectivity Mon Mar 28 12:20:03 2016 daemon.notice netifd: Interface 'wan6' is setting up now Mon Mar 28 12:20:03 2016 kern.info kernel: [ 59.327945] IPv6: ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready Mon Mar 28 12:20:03 2016 daemon.notice netifd: Interface 'wan6' is now up Mon Mar 28 12:20:03 2016 daemon.notice netifd: lan (3452): Sending discover... Mon Mar 28 12:20:03 2016 user.notice firewall: Reloading firewall due to ifup of wan (eth0) Mon Mar 28 12:20:04 2016 user.notice ddns-scripts[3632]: myddns_ipv4: PID '3632' started at 2016-03-28 12:20 Mon Mar 28 12:20:04 2016 user.notice firewall: Reloading firewall due to ifup of wan6 (eth2) Mon Mar 28 12:20:04 2016 user.warn ddns-scripts[3632]: myddns_ipv4: Service section disabled! - TERMINATE Mon Mar 28 12:20:04 2016 user.warn ddns-scripts[3632]: myddns_ipv4: PID '3632' exit WITH ERROR '1' at 2016-03-28 12:20 Mon Mar 28 12:20:04 2016 user.notice ddns-scripts[3801]: myddns_ipv6: PID '3801' started at 2016-03-28 12:20 Mon Mar 28 12:20:04 2016 user.warn ddns-scripts[3801]: myddns_ipv6: Service section disabled! - TERMINATE Mon Mar 28 12:20:04 2016 user.warn ddns-scripts[3801]: myddns_ipv6: PID '3801' exit WITH ERROR '1' at 2016-03-28 12:20 Mon Mar 28 12:20:05 2016 kern.info kernel: [ 61.277563] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:05 2016 kern.info kernel: [ 61.595785] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead. Mon Mar 28 12:20:05 2016 daemon.notice netifd: lan (3452): Sending select for 192.168.1.59... Mon Mar 28 12:20:06 2016 daemon.notice netifd: lan (3452): Lease of 192.168.1.59 obtained, lease time 86400 Mon Mar 28 12:20:06 2016 daemon.notice netifd: Interface 'lan' is now up Mon Mar 28 12:20:06 2016 daemon.info dnsmasq[3307]: reading /tmp/resolv.conf.auto Mon Mar 28 12:20:06 2016 daemon.info dnsmasq[3307]: using local addresses only for domain lan Mon Mar 28 12:20:06 2016 daemon.info dnsmasq[3307]: using nameserver 192.168.1.1#53 Mon Mar 28 12:20:06 2016 user.notice firewall: Reloading firewall due to ifup of lan (br-lan) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Enabling inline operation Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Found pid path directive (/var/snort/) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Running in IDS mode Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: --== Initializing Snort ==-- Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Initializing Output Plugins! Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Initializing Preprocessors! Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Initializing Plug-ins! Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Parsing Rules file "/etc/snort/snort_bridge.conf" Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: PortVar 'HTTP_PORTS' defined : Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: [ 36 80:90 311 383 555 591 593 631 801 808 818 901 972 1158 1220 1414 1533 1741 1830 1942 2231 2301 2381 2809 2980 3029 3037 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250 5600 6080 6173 6988 7000:7001 7071 7144:7145 7510 7770 7777:7779 8000 8008 8014 8028 8080:8082 8085 8088 8090 8118 8123 8180:8181 8222 8243 8280 8300 8333 8344 8500 8509 8800 8888 8899 8983 9000 9060 9080 9090:9091 9111 9290 9443 9999:10000 11371 12601 13014 15489 29991 33300 34412 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: PortVar 'SHELLCODE_PORTS' defined : Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: [ 1:65535 ] Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: PortVar 'ORACLE_PORTS' defined : Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: [ 1024:65535 ] Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: PortVar 'SSH_PORTS' defined : Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: [ 22 ] Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: PortVar 'FTP_PORTS' defined : Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: [ 21 2100 3535 ] Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: PortVar 'SIP_PORTS' defined : Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: [ 5060:5061 5600 ] Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: PortVar 'FILE_DATA_PORTS' defined : Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: [ 36 80:90 110 143 311 383 555 591 593 631 801 808 818 901 972 1158 1220 1414 1533 1741 1830 1942 2231 2301 2381 2809 2980 3029 3037 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250 5600 6080 6173 6988 7000:7001 7071 7144:7145 7510 7770 7777:7779 8000 8008 8014 8028 8080:8082 8085 8088 8090 8118 8123 8180:8181 8222 8243 8280 8300 8333 8344 8500 8509 8800 8888 8899 8983 9000 9060 9080 9090:9091 9111 9290 9443 9999:10000 11371 12601 13014 15489 29991 3330Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: PortVar 'GTP_PORTS' defined : Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: [ 2123 2152 3386 ] Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Detection: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Search-Method = AC-Full Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Search-Method-Optimizations = enabled Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Maximum pattern length = 20 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Found pid path directive (/var/snort/) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Tagged Packet Limit: 256 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_gtp_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_modbus_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_sip_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_pop_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_reputation_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dnp3_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_imap_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: done Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Log directory = /tmp/snort/ Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Normalizer config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: ip4: on Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: ip4::df: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: ip4::rf: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: ip4::tos: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: ip4::trim: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: ip4::ttl: on (min=1, new=5) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Normalizer config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp: on Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::ecn: stream Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::block: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::rsv: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::pad: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::req_urg: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::req_pay: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::req_urp: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::urp: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::opt: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::ips: on Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::trim_syn: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::trim_rst: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::trim_win: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: tcp::trim_mss: off Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Normalizer config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: icmp4: on Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Normalizer config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: ip6: on Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: ip6::hops: on (min=1, new=5) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Normalizer config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: icmp6: on Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Frag3 global config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max frags: 65536 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Fragment memory cap: 4194304 bytes Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Frag3 engine config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Bound Address: default Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Target-based policy: WINDOWS Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Fragment timeout: 180 seconds Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Fragment min_ttl: 1 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Fragment Anomalies: Alert Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Overlap Limit: 10 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Min fragment Length: 100 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Expected Streams: 39 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Stream global config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Track TCP sessions: ACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max TCP sessions: 10000 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: TCP cache pruning timeout: 30 seconds Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: TCP cache nominal timeout: 3600 seconds Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Memcap (for reassembly packet storage): 8388608 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Track UDP sessions: ACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max UDP sessions: 10000 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: UDP cache pruning timeout: 30 seconds Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: UDP cache nominal timeout: 180 seconds Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Track ICMP sessions: ACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max ICMP sessions: 65536 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Track IP sessions: INACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Log info if session memory consumption exceeds 1048576 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Send up to 2 active responses Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Wait at least 5 seconds between responses Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Protocol Aware Flushing: ACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Maximum Flush Point: 16000 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Stream TCP Policy config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Bound Address: default Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Reassembly Policy: WINDOWS Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Timeout: 180 seconds Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Limit on TCP Overlaps: 10 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Maximum number of bytes to queue per session: 1048576 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Maximum number of segs to queue per session: 2621 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Options: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Require 3-Way Handshake: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 3-Way Handshake Timeout: 180 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Detect Anomalies: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Reassembly Ports: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 21 client (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 22 client (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 23 client (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 25 client (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 36 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 42 client (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 53 client (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 70 client (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 79 client (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 80 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 81 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 82 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 83 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 84 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 85 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 86 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 87 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 88 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 89 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 90 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: additional ports configured but not printed. Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Stream UDP Policy config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Timeout: 180 seconds Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: HttpInspect Config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: GLOBAL CONFIG Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Detect Proxy Usage: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: IIS Unicode Map Filename: /etc/snort/unicode.map Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: IIS Unicode Map Codepage: 1252 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Memcap used for logging URI and Hostname: 150994944 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Gzip Memory: 838860 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Gzip Sessions: 1807 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Gzip Compress Depth: 65535 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Gzip Decompress Depth: 65535 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: DEFAULT SERVER CONFIG: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Server profile: All Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ports (PAF): 36 80 81 82 83 84 85 86 87 88 89 90 311 383 555 591 593 631 801 808 818 901 972 1158 1220 1414 1533 1741 1830 1942 2231 2301 2381 2809 2980 3029 3037 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250 5600 6080 6173 6988 7000 7001 7071 7144 7145 7510 7770 7777 7778 7779 8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8333 8344 8500 8509 8800 8888 8899 8983 9000 9060 9080 9090 9091 9111 9290 9443 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Server Flow Depth: 0 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Client Flow Depth: 0 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Chunk Length: 500000 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Small Chunk Length Evasion: chunk size <= 10, threshold >= 5 times Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Header Field Length: 750 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Number Header Fields: 100 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Number of WhiteSpaces allowed with header folding: 200 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Inspect Pipeline Requests: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: URI Discovery Strict Mode: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Allow Proxy Usage: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Disable Alerting: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Oversize Dir Length: 500 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Only inspect URI: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Normalize HTTP Headers: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Inspect HTTP Cookies: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Inspect HTTP Responses: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Extract Gzip from responses: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Decompress response files: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Unlimited decompression of gzip data from responses: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Normalize Javascripts in HTTP Responses: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Number of WhiteSpaces allowed with Javascript Obfuscation in HTTP responses: 200 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Normalize HTTP Cookies: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Enable XFF and True Client IP: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Log HTTP URI data: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Log HTTP Hostname data: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Extended ASCII code support in URI: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ascii: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Double Decoding: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: %U Encoding: YES alert: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Bare Byte: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: UTF 8: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: IIS Unicode: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Multiple Slash: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: IIS Backslash: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Directory Traversal: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Web Root Traversal: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Apache WhiteSpace: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: IIS Delimiter: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Non-RFC Compliant Characters: 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: rpc_decode arguments: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ports to decode RPC on: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: alert_fragments: INACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: alert_large_fragments: INACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: alert_incomplete: INACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: alert_multiple_requests: INACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Portscan Detection Config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Detect Protocols: TCP UDP ICMP IP Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Sensitivity Level: Medium Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Memcap (in bytes): 500000 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Number of Nodes: 978 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: FTPTelnet Config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: GLOBAL CONFIG Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Inspection Type: stateful Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Check for Encrypted Traffic: YES alert: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Continue to check encrypted data: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: TELNET CONFIG: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ports: 23 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Are You There Threshold: 20 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Normalize: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Detect Anomalies: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: FTP CONFIG: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: FTP Server: default Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ports (PAF): 21 2100 3535 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Check for Telnet Cmds: YES alert: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ignore Telnet Cmd Operations: YES alert: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ignore open data channels: NO Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: FTP Client: default Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Check for Bounce Attacks: YES alert: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Check for Telnet Cmds: YES alert: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ignore Telnet Cmd Operations: YES alert: YES Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Response Length: 256 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: SSH config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Autodetection: ENABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Challenge-Response Overflow Alert: ENABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: SSH1 CRC32 Alert: ENABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Server Version String Overflow Alert: ENABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Protocol Mismatch Alert: ENABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Bad Message Direction Alert: DISABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Bad Payload Size Alert: DISABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Unrecognized Version Alert: DISABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Encrypted Packets: 20 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Server Version String Length: 100 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: MaxClientBytes: 19600 (Default) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ports: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 22 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: DCE/RPC 2 Preprocessor Configuration Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Global Configuration Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: DCE/RPC Defragmentation: Enabled Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Memcap: 102400 KB Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Events: co Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: SMB Fingerprint policy: Disabled Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Server Default Configuration Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Policy: WinXP Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Detect ports (PAF) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: SMB: 139 445 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: TCP: 135 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: UDP: 135 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: RPC over HTTP server: 593 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: RPC over HTTP proxy: None Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Autodetect ports (PAF) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: SMB: None Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: TCP: 1025-65535 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: UDP: 1025-65535 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: RPC over HTTP server: 1025-65535 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: RPC over HTTP proxy: None Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Invalid SMB shares: C$ D$ ADMIN$ Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Maximum SMB command chaining: 3 commands Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: SMB file inspection: Disabled Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: DNS config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: DNS Client rdata txt Overflow Alert: ACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Obsolete DNS RR Types Alert: INACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Experimental DNS RR Types Alert: INACTIVE Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ports: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 53 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: SSLPP config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Encrypted packets: not inspected Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ports: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 443 465 563 636 989 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 992 993 994 995 7801 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 7802 7900 7901 7902 7903 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 7904 7905 7906 7907 7908 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 7909 7910 7911 7912 7913 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 7914 7915 7916 7917 7918 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 7919 7920 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Server side data is trusted Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Maximum SSL Heartbeat length: 0 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Sensitive Data preprocessor config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Global Alert Threshold: 25 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Masked Output: DISABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: SIP config: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max number of sessions: 1024 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max number of dialogs in a session: 4 (Default) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Status: ENABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ignore media channel: DISABLED Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max URI length: 512 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Call ID length: 80 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Request name length: 20 (Default) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max From length: 256 (Default) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max To length: 256 (Default) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Via length: 1024 (Default) Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Contact length: 512 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Max Content length: 2048 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Ports: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 5060 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 5061 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: 5600 Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Methods: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: invite Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: cancel Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: ack Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: bye Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: register Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: options Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: refer Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: subscribe Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: update Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: join Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: info Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: message Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: notify Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: benotify Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: do Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: qauth Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: sprack Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: publish Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: service Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: unsubscribe Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: prack Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: +++++++++++++++++++++++++++++++++++++++++++++++++++ Mon Mar 28 12:20:06 2016 daemon.notice snort[3857]: Initializing rule chains... Mon Mar 28 12:20:07 2016 daemon.notice snort[3857]: WARNING: /etc/snort/rules/snort.rules(1112) threshold (in rule) is deprecated; use detection_filter instead. Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'blockdomain' is now down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'loopback' is now down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'loopback' is disabled Mon Mar 28 12:20:09 2016 daemon.warn dnsmasq[3307]: no servers found in /tmp/resolv.conf.auto, will retry Mon Mar 28 12:20:09 2016 daemon.notice netifd: Network device 'lo' link is down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'loopback' has link connectivity loss Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'wan' is now down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'wan' is disabled Mon Mar 28 12:20:09 2016 kern.notice kernel: [ 65.328302] eth0: Link down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Network device 'eth0' link is down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'wan' has link connectivity loss Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'wan6' is now down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'wan6' is disabled Mon Mar 28 12:20:09 2016 kern.notice kernel: [ 65.377957] eth2: Link down Mon Mar 28 12:20:09 2016 daemon.notice netifd: lan (3452): Received SIGTERM Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'lan' is now down Mon Mar 28 12:20:09 2016 kern.info kernel: [ 65.393075] br-lan: port 1(eth1) entered disabled state Mon Mar 28 12:20:09 2016 kern.info kernel: [ 65.394481] device eth1 left promiscuous mode Mon Mar 28 12:20:09 2016 kern.info kernel: [ 65.394499] br-lan: port 1(eth1) entered disabled state Mon Mar 28 12:20:09 2016 kern.notice kernel: [ 65.414407] eth1: Link down Mon Mar 28 12:20:09 2016 kern.info kernel: [ 65.417709] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'lan' is disabled Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'blockdomain' is disabled Mon Mar 28 12:20:09 2016 daemon.notice netifd: Network device 'eth2' link is down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'wan6' has link connectivity loss Mon Mar 28 12:20:09 2016 daemon.notice netifd: Network device 'eth1' link is down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Bridge 'br-lan' link is down Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'lan' has link connectivity loss Mon Mar 28 12:20:09 2016 daemon.notice netifd: Interface 'blockdomain' has link connectivity loss Mon Mar 28 12:20:10 2016 daemon.warn netifd: You have delegated IPv6-prefixes but haven't assigned them to any interface. Did you forget to set option ip6assign on your lan-interfaces? Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'lan' is enabled Mon Mar 28 12:20:10 2016 kern.notice kernel: [ 66.690533] eth1: 1000 Mbps Full duplex, port 1 Mon Mar 28 12:20:10 2016 kern.info kernel: [ 66.694464] device eth1 entered promiscuous mode Mon Mar 28 12:20:10 2016 kern.info kernel: [ 66.696366] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:10 2016 kern.info kernel: [ 66.696398] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'loopback' is enabled Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'loopback' is setting up now Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'loopback' is now up Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'wan' is enabled Mon Mar 28 12:20:10 2016 kern.notice kernel: [ 66.722423] eth0: 1000 Mbps Full duplex, port 0 Mon Mar 28 12:20:10 2016 kern.notice kernel: [ 66.744578] eth2: 1000 Mbps Full duplex, port 2 Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'wan6' is enabled Mon Mar 28 12:20:10 2016 daemon.notice netifd: Bridge 'br-lan' link is up Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'lan' has link connectivity Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'lan' is setting up now Mon Mar 28 12:20:10 2016 daemon.notice netifd: Network device 'eth1' link is up Mon Mar 28 12:20:10 2016 daemon.notice netifd: Network device 'lo' link is up Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'loopback' has link connectivity Mon Mar 28 12:20:10 2016 daemon.notice netifd: Network device 'eth0' link is up Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'wan' has link connectivity Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'wan' is setting up now Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'wan' is now up Mon Mar 28 12:20:10 2016 daemon.notice netifd: Network device 'eth2' link is up Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'wan6' has link connectivity Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'wan6' is setting up now Mon Mar 28 12:20:10 2016 daemon.notice netifd: Interface 'wan6' is now up Mon Mar 28 12:20:10 2016 daemon.notice netifd: lan (4265): udhcpc (v1.23.2) started Mon Mar 28 12:20:10 2016 daemon.notice snort[3857]: 4347 Snort rules read Mon Mar 28 12:20:10 2016 daemon.notice snort[3857]: 4347 detection rules Mon Mar 28 12:20:10 2016 daemon.notice snort[3857]: 0 decoder rules Mon Mar 28 12:20:10 2016 daemon.notice snort[3857]: 0 preprocessor rules Mon Mar 28 12:20:10 2016 daemon.notice snort[3857]: 4347 Option Chains linked into 569 Chain Headers Mon Mar 28 12:20:10 2016 daemon.notice snort[3857]: 0 Dynamic rules Mon Mar 28 12:20:10 2016 daemon.notice snort[3857]: +++++++++++++++++++++++++++++++++++++++++++++++++++ Mon Mar 28 12:20:10 2016 daemon.notice snort[3857]: Mon Mar 28 12:20:10 2016 daemon.notice netifd: lan (4265): Sending discover... Mon Mar 28 12:20:10 2016 daemon.notice netifd: lan (4265): Performing a DHCP renew Mon Mar 28 12:20:10 2016 daemon.notice netifd: lan (4265): Sending discover... Mon Mar 28 12:20:11 2016 daemon.notice netifd: lan (4265): Sending select for 192.168.1.59... Mon Mar 28 12:20:11 2016 daemon.notice netifd: lan (4265): Lease of 192.168.1.59 obtained, lease time 86400 Mon Mar 28 12:20:11 2016 daemon.notice netifd: Interface 'lan' is now up Mon Mar 28 12:20:11 2016 daemon.info dnsmasq[3307]: reading /tmp/resolv.conf.auto Mon Mar 28 12:20:11 2016 daemon.info dnsmasq[3307]: using local addresses only for domain lan Mon Mar 28 12:20:11 2016 daemon.info dnsmasq[3307]: using nameserver 192.168.1.1#53 Mon Mar 28 12:20:11 2016 user.notice firewall: Reloading firewall due to ifup of wan (eth0) Mon Mar 28 12:20:11 2016 kern.notice kernel: [ 67.737533] eth2: Link down Mon Mar 28 12:20:12 2016 user.notice ddns-scripts[4510]: myddns_ipv4: PID '4510' started at 2016-03-28 12:20 Mon Mar 28 12:20:12 2016 user.warn ddns-scripts[4510]: myddns_ipv4: Service section disabled! - TERMINATE Mon Mar 28 12:20:12 2016 user.warn ddns-scripts[4510]: myddns_ipv4: PID '4510' exit WITH ERROR '1' at 2016-03-28 12:20 Mon Mar 28 12:20:12 2016 user.notice firewall: Reloading firewall due to ifup of wan6 (eth2) Mon Mar 28 12:20:12 2016 kern.info kernel: [ 68.687595] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:13 2016 user.notice ddns-scripts[4685]: myddns_ipv6: PID '4685' started at 2016-03-28 12:20 Mon Mar 28 12:20:13 2016 user.notice firewall: Reloading firewall due to ifup of lan (br-lan) Mon Mar 28 12:20:13 2016 user.warn ddns-scripts[4685]: myddns_ipv6: Service section disabled! - TERMINATE Mon Mar 28 12:20:13 2016 user.warn ddns-scripts[4685]: myddns_ipv6: PID '4685' exit WITH ERROR '1' at 2016-03-28 12:20 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Enabling inline operation Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Found pid path directive (/var/snort/) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Running in IDS mode Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: --== Initializing Snort ==-- Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Initializing Output Plugins! Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Initializing Preprocessors! Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Initializing Plug-ins! Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Parsing Rules file "/etc/snort/snort_bridge.conf" Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: PortVar 'HTTP_PORTS' defined : Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: [ 36 80:90 311 383 555 591 593 631 801 808 818 901 972 1158 1220 1414 1533 1741 1830 1942 2231 2301 2381 2809 2980 3029 3037 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250 5600 6080 6173 6988 7000:7001 7071 7144:7145 7510 7770 7777:7779 8000 8008 8014 8028 8080:8082 8085 8088 8090 8118 8123 8180:8181 8222 8243 8280 8300 8333 8344 8500 8509 8800 8888 8899 8983 9000 9060 9080 9090:9091 9111 9290 9443 9999:10000 11371 12601 13014 15489 29991 33300 34412 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: PortVar 'SHELLCODE_PORTS' defined : Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: [ 1:65535 ] Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: PortVar 'ORACLE_PORTS' defined : Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: [ 1024:65535 ] Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: PortVar 'SSH_PORTS' defined : Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: [ 22 ] Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: PortVar 'FTP_PORTS' defined : Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: [ 21 2100 3535 ] Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: PortVar 'SIP_PORTS' defined : Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: [ 5060:5061 5600 ] Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: PortVar 'FILE_DATA_PORTS' defined : Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: [ 36 80:90 110 143 311 383 555 591 593 631 801 808 818 901 972 1158 1220 1414 1533 1741 1830 1942 2231 2301 2381 2809 2980 3029 3037 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250 5600 6080 6173 6988 7000:7001 7071 7144:7145 7510 7770 7777:7779 8000 8008 8014 8028 8080:8082 8085 8088 8090 8118 8123 8180:8181 8222 8243 8280 8300 8333 8344 8500 8509 8800 8888 8899 8983 9000 9060 9080 9090:9091 9111 9290 9443 9999:10000 11371 12601 13014 15489 29991 3330Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: PortVar 'GTP_PORTS' defined : Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: [ 2123 2152 3386 ] Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Detection: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Search-Method = AC-Full Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Search-Method-Optimizations = enabled Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Maximum pattern length = 20 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Found pid path directive (/var/snort/) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Tagged Packet Limit: 256 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic engine /usr/lib/snort_dynamicengine/libsf_engine.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_gtp_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_modbus_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_sip_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_pop_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_reputation_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_dnp3_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_imap_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Loading dynamic preprocessor library /usr/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: done Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Finished Loading all dynamic preprocessor libs from /usr/lib/snort_dynamicpreprocessor/ Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Log directory = /tmp/snort/ Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Normalizer config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: ip4: on Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: ip4::df: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: ip4::rf: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: ip4::tos: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: ip4::trim: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: ip4::ttl: on (min=1, new=5) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Normalizer config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp: on Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::ecn: stream Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::block: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::rsv: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::pad: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::req_urg: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::req_pay: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::req_urp: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::urp: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::opt: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::ips: on Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::trim_syn: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::trim_rst: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::trim_win: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: tcp::trim_mss: off Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Normalizer config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: icmp4: on Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Normalizer config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: ip6: on Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: ip6::hops: on (min=1, new=5) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Normalizer config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: icmp6: on Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Frag3 global config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max frags: 65536 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Fragment memory cap: 4194304 bytes Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Frag3 engine config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Bound Address: default Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Target-based policy: WINDOWS Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Fragment timeout: 180 seconds Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Fragment min_ttl: 1 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Fragment Anomalies: Alert Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Overlap Limit: 10 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Min fragment Length: 100 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Expected Streams: 39 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Stream global config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Track TCP sessions: ACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max TCP sessions: 10000 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: TCP cache pruning timeout: 30 seconds Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: TCP cache nominal timeout: 3600 seconds Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Memcap (for reassembly packet storage): 8388608 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Track UDP sessions: ACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max UDP sessions: 10000 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: UDP cache pruning timeout: 30 seconds Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: UDP cache nominal timeout: 180 seconds Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Track ICMP sessions: ACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max ICMP sessions: 65536 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Track IP sessions: INACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Log info if session memory consumption exceeds 1048576 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Send up to 2 active responses Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Wait at least 5 seconds between responses Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Protocol Aware Flushing: ACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Maximum Flush Point: 16000 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Stream TCP Policy config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Bound Address: default Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Reassembly Policy: WINDOWS Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Timeout: 180 seconds Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Limit on TCP Overlaps: 10 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Maximum number of bytes to queue per session: 1048576 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Maximum number of segs to queue per session: 2621 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Options: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Require 3-Way Handshake: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 3-Way Handshake Timeout: 180 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Detect Anomalies: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Reassembly Ports: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 21 client (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 22 client (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 23 client (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 25 client (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 36 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 42 client (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 53 client (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 70 client (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 79 client (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 80 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 81 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 82 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 83 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 84 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 85 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 86 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 87 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 88 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 89 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 90 client (Footprint-IPS) server (Footprint-IPS) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: additional ports configured but not printed. Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Stream UDP Policy config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Timeout: 180 seconds Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: HttpInspect Config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: GLOBAL CONFIG Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Detect Proxy Usage: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: IIS Unicode Map Filename: /etc/snort/unicode.map Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: IIS Unicode Map Codepage: 1252 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Memcap used for logging URI and Hostname: 150994944 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Gzip Memory: 838860 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Gzip Sessions: 1807 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Gzip Compress Depth: 65535 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Gzip Decompress Depth: 65535 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: DEFAULT SERVER CONFIG: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Server profile: All Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ports (PAF): 36 80 81 82 83 84 85 86 87 88 89 90 311 383 555 591 593 631 801 808 818 901 972 1158 1220 1414 1533 1741 1830 1942 2231 2301 2381 2809 2980 3029 3037 3057 3128 3443 3702 4000 4343 4848 5000 5117 5250 5600 6080 6173 6988 7000 7001 7071 7144 7145 7510 7770 7777 7778 7779 8000 8008 8014 8028 8080 8081 8082 8085 8088 8090 8118 8123 8180 8181 8222 8243 8280 8300 8333 8344 8500 8509 8800 8888 8899 8983 9000 9060 9080 9090 9091 9111 9290 9443 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Server Flow Depth: 0 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Client Flow Depth: 0 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Chunk Length: 500000 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Small Chunk Length Evasion: chunk size <= 10, threshold >= 5 times Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Header Field Length: 750 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Number Header Fields: 100 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Number of WhiteSpaces allowed with header folding: 200 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Inspect Pipeline Requests: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: URI Discovery Strict Mode: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Allow Proxy Usage: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Disable Alerting: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Oversize Dir Length: 500 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Only inspect URI: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Normalize HTTP Headers: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Inspect HTTP Cookies: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Inspect HTTP Responses: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Extract Gzip from responses: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Decompress response files: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Unlimited decompression of gzip data from responses: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Normalize Javascripts in HTTP Responses: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Number of WhiteSpaces allowed with Javascript Obfuscation in HTTP responses: 200 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Normalize HTTP Cookies: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Enable XFF and True Client IP: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Log HTTP URI data: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Log HTTP Hostname data: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Extended ASCII code support in URI: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ascii: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Double Decoding: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: %U Encoding: YES alert: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Bare Byte: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: UTF 8: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: IIS Unicode: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Multiple Slash: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: IIS Backslash: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Directory Traversal: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Web Root Traversal: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Apache WhiteSpace: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: IIS Delimiter: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Non-RFC Compliant Characters: 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Whitespace Characters: 0x09 0x0b 0x0c 0x0d Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: rpc_decode arguments: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ports to decode RPC on: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: alert_fragments: INACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: alert_large_fragments: INACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: alert_incomplete: INACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: alert_multiple_requests: INACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Portscan Detection Config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Detect Protocols: TCP UDP ICMP IP Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Sensitivity Level: Medium Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Memcap (in bytes): 500000 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Number of Nodes: 978 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: FTPTelnet Config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: GLOBAL CONFIG Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Inspection Type: stateful Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Check for Encrypted Traffic: YES alert: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Continue to check encrypted data: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: TELNET CONFIG: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ports: 23 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Are You There Threshold: 20 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Normalize: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Detect Anomalies: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: FTP CONFIG: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: FTP Server: default Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ports (PAF): 21 2100 3535 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Check for Telnet Cmds: YES alert: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ignore Telnet Cmd Operations: YES alert: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ignore open data channels: NO Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: FTP Client: default Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Check for Bounce Attacks: YES alert: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Check for Telnet Cmds: YES alert: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ignore Telnet Cmd Operations: YES alert: YES Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Response Length: 256 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: SSH config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Autodetection: ENABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Challenge-Response Overflow Alert: ENABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: SSH1 CRC32 Alert: ENABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Server Version String Overflow Alert: ENABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Protocol Mismatch Alert: ENABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Bad Message Direction Alert: DISABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Bad Payload Size Alert: DISABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Unrecognized Version Alert: DISABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Encrypted Packets: 20 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Server Version String Length: 100 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: MaxClientBytes: 19600 (Default) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ports: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 22 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: DCE/RPC 2 Preprocessor Configuration Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Global Configuration Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: DCE/RPC Defragmentation: Enabled Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Memcap: 102400 KB Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Events: co Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: SMB Fingerprint policy: Disabled Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Server Default Configuration Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Policy: WinXP Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Detect ports (PAF) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: SMB: 139 445 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: TCP: 135 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: UDP: 135 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: RPC over HTTP server: 593 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: RPC over HTTP proxy: None Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Autodetect ports (PAF) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: SMB: None Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: TCP: 1025-65535 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: UDP: 1025-65535 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: RPC over HTTP server: 1025-65535 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: RPC over HTTP proxy: None Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Invalid SMB shares: C$ D$ ADMIN$ Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Maximum SMB command chaining: 3 commands Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: SMB file inspection: Disabled Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: DNS config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: DNS Client rdata txt Overflow Alert: ACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Obsolete DNS RR Types Alert: INACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Experimental DNS RR Types Alert: INACTIVE Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ports: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 53 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: SSLPP config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Encrypted packets: not inspected Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ports: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 443 465 563 636 989 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 992 993 994 995 7801 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 7802 7900 7901 7902 7903 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 7904 7905 7906 7907 7908 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 7909 7910 7911 7912 7913 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 7914 7915 7916 7917 7918 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 7919 7920 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Server side data is trusted Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Maximum SSL Heartbeat length: 0 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Sensitive Data preprocessor config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Global Alert Threshold: 25 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Masked Output: DISABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: SIP config: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max number of sessions: 1024 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max number of dialogs in a session: 4 (Default) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Status: ENABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ignore media channel: DISABLED Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max URI length: 512 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Call ID length: 80 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Request name length: 20 (Default) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max From length: 256 (Default) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max To length: 256 (Default) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Via length: 1024 (Default) Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Contact length: 512 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Max Content length: 2048 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Ports: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 5060 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 5061 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: 5600 Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Methods: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: invite Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: cancel Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: ack Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: bye Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: register Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: options Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: refer Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: subscribe Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: update Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: join Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: info Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: message Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: notify Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: benotify Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: do Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: qauth Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: sprack Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: publish Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: service Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: unsubscribe Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: prack Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: +++++++++++++++++++++++++++++++++++++++++++++++++++ Mon Mar 28 12:20:16 2016 daemon.notice snort[4895]: Initializing rule chains... Mon Mar 28 12:20:17 2016 daemon.notice snort[4895]: WARNING: /etc/snort/rules/snort.rules(1112) threshold (in rule) is deprecated; use detection_filter instead. Mon Mar 28 12:20:20 2016 daemon.notice snort[4895]: 4347 Snort rules read Mon Mar 28 12:20:20 2016 daemon.notice snort[4895]: 4347 detection rules Mon Mar 28 12:20:20 2016 daemon.notice snort[4895]: 0 decoder rules Mon Mar 28 12:20:20 2016 daemon.notice snort[4895]: 0 preprocessor rules Mon Mar 28 12:20:20 2016 daemon.notice snort[4895]: 4347 Option Chains linked into 569 Chain Headers Mon Mar 28 12:20:20 2016 daemon.notice snort[4895]: 0 Dynamic rules Mon Mar 28 12:20:20 2016 daemon.notice snort[4895]: +++++++++++++++++++++++++++++++++++++++++++++++++++ Mon Mar 28 12:20:20 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:21 2016 user.emerg procd: Cannot change large-receive-offload Mon Mar 28 12:20:23 2016 kern.notice kernel: [ 79.717360] eth0: Link down Mon Mar 28 12:20:24 2016 daemon.notice netifd: Network device 'eth0' link is down Mon Mar 28 12:20:24 2016 daemon.notice netifd: Interface 'wan' has link connectivity loss Mon Mar 28 12:20:24 2016 daemon.notice netifd: Interface 'wan' is now down Mon Mar 28 12:20:24 2016 daemon.notice netifd: Interface 'wan' is disabled Mon Mar 28 12:20:24 2016 daemon.notice netifd: Interface 'wan' is enabled Mon Mar 28 12:20:24 2016 kern.info kernel: [ 80.712076] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready Mon Mar 28 12:20:24 2016 user.emerg procd: Cannot change large-receive-offload Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +-------------------[Rule Port Counts]--------------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | tcp udp icmp ip Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | src 1348 8 0 0 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | dst 2306 105 0 0 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | any 385 195 0 0 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | nc 241 189 0 0 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | s+d 28 0 0 0 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +---------------------------------------------------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +-----------------------[detection-filter-config]------------------------------ Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | memory-cap : 1048576 bytes Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +-----------------------[detection-filter-rules]------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: ------------------------------------------------------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +-----------------------[rate-filter-config]----------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | memory-cap : 1048576 bytes Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +-----------------------[rate-filter-rules]------------------------------------ Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | none Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: ------------------------------------------------------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +-----------------------[event-filter-config]---------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | memory-cap : 1048576 bytes Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +-----------------------[event-filter-global]---------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | none Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +-----------------------[event-filter-local]----------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2011146 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500009 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500008 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500007 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500006 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500005 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500004 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500003 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500002 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500001 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500000 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021018 type=Both tracking=dst count=10 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003585 type=Limit tracking=src count=3 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003583 type=Limit tracking=src count=3 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403338 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403337 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403336 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403335 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403334 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403333 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403332 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403331 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403330 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403329 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403328 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403354 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403353 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403352 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403351 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403350 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403349 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403348 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403347 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403346 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403345 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403344 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403343 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403342 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403341 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403340 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403339 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2001564 type=Limit tracking=src count=5 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2001562 type=Limit tracking=src count=2 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2019950 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2019897 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2019922 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404341 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404340 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404339 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404338 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404337 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404336 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404335 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404334 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404333 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404332 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404331 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404330 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404329 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404328 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404327 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404326 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404349 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404348 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404347 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404346 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404345 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404344 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404343 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2001316 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404342 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2001315 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404309 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404308 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404307 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404306 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404305 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404304 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404303 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404302 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404301 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404300 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404325 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404324 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404323 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404322 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404321 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404320 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404319 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404318 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404317 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404316 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404315 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404314 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404313 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404312 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404311 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404310 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018569 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018568 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003493 type=Limit tracking=src count=2 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003497 type=Limit tracking=src count=3 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2019778 type=Both tracking=dst count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003566 type=Limit tracking=src count=3 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403313 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403312 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403311 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403310 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403309 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403308 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403307 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403306 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403305 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403304 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403303 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403302 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403301 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403300 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403327 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403326 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403325 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403324 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403323 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403322 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403321 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403320 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403319 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403318 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403317 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403316 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403315 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403314 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003397 type=Both tracking=src count=1 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2402001 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2402000 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003277 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003276 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003275 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003274 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003273 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003272 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003271 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003270 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003269 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003268 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003267 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003266 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2020661 type=Limit tracking=dst count=1 seconds=1200 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003263 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003262 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003281 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003280 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003279 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003278 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003387 type=Limit tracking=src count=5 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003384 type=Limit tracking=src count=1 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404207 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404206 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404205 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404204 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404203 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404202 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404201 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404200 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404181 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404180 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404179 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404178 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404177 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404176 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404175 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404174 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404173 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404172 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404171 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404170 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404169 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404168 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404167 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404166 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404197 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404196 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404195 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404194 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404193 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404192 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404191 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404190 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404189 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404188 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404187 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404186 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404185 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404184 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404183 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404182 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2002402 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2002400 type=Limit tracking=src count=2 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404165 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404164 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404163 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404162 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404161 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404160 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404159 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404158 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404157 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404156 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404155 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404154 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404153 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404152 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404151 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404150 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2020712 type=Limit tracking=src count=2 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404028 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404027 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404026 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404025 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404024 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404023 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404022 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404021 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404020 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404019 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404018 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404017 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404016 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404015 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404014 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404013 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404044 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404043 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018383 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404042 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018382 type=Limit tracking=dst count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404041 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404040 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404039 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018378 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404038 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404037 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018377 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404036 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404035 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018374 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404034 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404033 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018373 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018372 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404032 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404031 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404030 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404029 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018389 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018388 type=Limit tracking=src count=1 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404012 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404011 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404010 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404009 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404008 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404007 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404006 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404005 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404004 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404003 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404002 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404001 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404000 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404092 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404091 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404090 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404089 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404088 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404087 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404086 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404085 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404084 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404083 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404082 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404081 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404080 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404079 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404078 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404077 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404095 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404094 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404093 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404060 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404059 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404058 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404057 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404056 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404055 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404054 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404053 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404052 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404051 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404050 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404049 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404048 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404047 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404046 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404045 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404076 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404075 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404074 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404073 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404072 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404071 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404070 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404069 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404068 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404067 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404066 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404065 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404064 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404063 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404062 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2404061 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2019418 type=Both tracking=src count=50 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003261 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003260 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003259 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003258 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003257 type=Both tracking=src count=2 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003256 type=Both tracking=src count=2 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003255 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2003254 type=Both tracking=src count=1 seconds=900 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021691 type=Limit tracking=src count=3 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018433 type=Limit tracking=src count=1 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018432 type=Limit tracking=src count=1 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018431 type=Limit tracking=src count=1 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018430 type=Limit tracking=src count=1 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2000031 type=Limit tracking=dst count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2000049 type=Limit tracking=dst count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2000048 type=Limit tracking=dst count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021575 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021574 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021573 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021572 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2008549 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021444 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021443 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021410 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021409 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2000929 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405024 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405023 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405022 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405021 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405020 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405019 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405018 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405017 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405016 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405015 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405014 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405013 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405012 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405011 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405010 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405009 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405040 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405039 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405038 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405037 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405036 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405035 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405034 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405033 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405032 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405031 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405030 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405029 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405028 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405027 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405026 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405025 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405008 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405007 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405006 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405005 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405004 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405003 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405002 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405001 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405000 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405046 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405045 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405044 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405043 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405042 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2405041 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2022618 type=Limit tracking=src count=1 seconds=30 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2022617 type=Limit tracking=src count=1 seconds=30 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2022616 type=Limit tracking=src count=1 seconds=30 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2022615 type=Limit tracking=src count=1 seconds=30 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018090 type=Limit tracking=src count=1 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2018088 type=Limit tracking=src count=1 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021331 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021330 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021329 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021328 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021327 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021326 type=Limit tracking=src count=3 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2020240 type=Limit tracking=src count=1 seconds=180 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2001872 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2001864 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2001858 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2001855 type=Limit tracking=src count=1 seconds=360 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500057 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500056 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500055 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500054 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500053 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500052 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500051 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500050 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500049 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500048 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500047 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500046 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500045 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500044 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500043 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500042 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500073 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500072 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500071 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500070 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500069 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500068 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500067 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500066 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500065 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500064 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500063 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500062 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500061 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500060 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500059 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500058 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500025 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500024 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500023 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500022 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500021 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500020 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500019 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500018 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500017 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500016 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500015 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500014 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500013 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500012 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500011 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500010 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500041 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500040 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500039 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500038 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500037 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500036 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500035 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500034 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500033 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500032 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500031 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500030 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500029 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500028 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500027 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500026 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021333 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2021332 type=Both tracking=src count=10 seconds=120 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500075 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2500074 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403397 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403396 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403395 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403394 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403393 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403392 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403391 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403390 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403389 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403388 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403387 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403370 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403369 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403368 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403367 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403366 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403365 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403364 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403363 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403362 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403361 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403360 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403359 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403358 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403357 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403356 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403355 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403386 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403385 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403384 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403383 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403382 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403381 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403380 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403379 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403378 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403377 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403376 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403375 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403374 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403373 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403372 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2403371 type=Limit tracking=src count=1 seconds=3600 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2022291 type=Limit tracking=src count=1 seconds=60 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=1 sig-id=2008085 type=Limit tracking=src count=2 seconds=300 Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: +-----------------------[suppression]------------------------------------------ Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=129 sig-id=20 tracking=none Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: | gen-id=129 sig-id=12 tracking=none Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: ------------------------------------------------------------------------------- Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: Rule application order: activation->dynamic->pass->drop->sdrop->reject->alert->log Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: Verifying Preprocessor Configurations! Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.http.rtf.download' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'SunDown.EK' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.BotccIP' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'et.WinHttpRequest' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.DshieldIP' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.http.javaclient' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'AnglerEK' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.CottonCastle.Exploit' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'et.MCOFF' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'EXE2' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'et.MS.XMLHTTP.ip.request' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.ZoneAlarm.Site.Download' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.CompIP' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'et.MS.XMLHTTP.no.exe.request' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'et.MS.WinHttpRequest.no.exe.request' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ETPRO.RTF' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.pdf.in.http' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.Evil' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'et.JavaArchiveOrClass' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'et.DocVBAProject' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.Adobe.Site.Download' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.JS.Obfus.Func' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.http.javaclient.vulnerable' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.http.binary' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.wininet.UA' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'et.http.PK' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'ET.http.javaclient.SakuraPorts' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'NuclearEK' is set but not ever checked. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: WARNING: flowbits key 'FlimKit.SWF.Redirect' is checked but not ever set. Mon Mar 28 12:20:26 2016 daemon.notice snort[4895]: 78 out of 1024 flowbits in use. Mon Mar 28 12:20:26 2016 kern.notice kernel: [ 82.687300] eth1: Link down Mon Mar 28 12:20:26 2016 daemon.notice netifd: Network device 'eth0' link is up Mon Mar 28 12:20:26 2016 daemon.notice netifd: Interface 'wan' has link connectivity Mon Mar 28 12:20:26 2016 daemon.notice netifd: Interface 'wan' is setting up now Mon Mar 28 12:20:26 2016 kern.notice kernel: [ 82.727756] eth0: 1000 Mbps Full duplex, port 0 Mon Mar 28 12:20:26 2016 kern.info kernel: [ 82.727782] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready Mon Mar 28 12:20:26 2016 daemon.notice netifd: Interface 'wan' is now up Mon Mar 28 12:20:26 2016 user.notice firewall: Reloading firewall due to ifup of wan (eth0) Mon Mar 28 12:20:27 2016 user.notice ddns-scripts[5081]: myddns_ipv4: PID '5081' started at 2016-03-28 12:20 Mon Mar 28 12:20:27 2016 user.warn ddns-scripts[5081]: myddns_ipv4: Service section disabled! - TERMINATE Mon Mar 28 12:20:27 2016 user.warn ddns-scripts[5081]: myddns_ipv4: PID '5081' exit WITH ERROR '1' at 2016-03-28 12:20 Mon Mar 28 12:20:27 2016 daemon.notice netifd: Network device 'eth1' link is down Mon Mar 28 12:20:27 2016 kern.info kernel: [ 83.727830] br-lan: port 1(eth1) entered disabled state Mon Mar 28 12:20:27 2016 user.emerg procd: Cannot change large-receive-offload Mon Mar 28 12:20:28 2016 daemon.notice netifd: Bridge 'br-lan' link is down Mon Mar 28 12:20:28 2016 daemon.notice netifd: Interface 'lan' has link connectivity loss Mon Mar 28 12:20:28 2016 daemon.notice netifd: lan (4265): Received SIGTERM Mon Mar 28 12:20:29 2016 daemon.notice netifd: Network device 'eth1' link is up Mon Mar 28 12:20:29 2016 daemon.notice netifd: Bridge 'br-lan' link is up Mon Mar 28 12:20:29 2016 daemon.notice netifd: Interface 'lan' has link connectivity Mon Mar 28 12:20:29 2016 daemon.notice netifd: Interface 'lan' is setting up now Mon Mar 28 12:20:29 2016 kern.notice kernel: [ 85.697652] eth1: 1000 Mbps Full duplex, port 1 Mon Mar 28 12:20:29 2016 kern.info kernel: [ 85.697693] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:29 2016 kern.info kernel: [ 85.697727] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:29 2016 daemon.notice netifd: lan (5181): udhcpc (v1.23.2) started Mon Mar 28 12:20:29 2016 daemon.notice netifd: lan (5181): Sending discover... Mon Mar 28 12:20:29 2016 daemon.notice netifd: lan (5181): Sending select for 192.168.1.59... Mon Mar 28 12:20:29 2016 daemon.notice netifd: lan (5181): Lease of 192.168.1.59 obtained, lease time 86400 Mon Mar 28 12:20:29 2016 daemon.warn dnsmasq[3307]: no servers found in /tmp/resolv.conf.auto, will retry Mon Mar 28 12:20:29 2016 daemon.notice netifd: Interface 'lan' is now up Mon Mar 28 12:20:29 2016 daemon.info dnsmasq[3307]: reading /tmp/resolv.conf.auto Mon Mar 28 12:20:29 2016 daemon.info dnsmasq[3307]: using local addresses only for domain lan Mon Mar 28 12:20:29 2016 daemon.info dnsmasq[3307]: using nameserver 192.168.1.1#53 Mon Mar 28 12:20:30 2016 user.notice firewall: Reloading firewall due to ifup of lan (br-lan) Mon Mar 28 12:20:30 2016 daemon.notice netifd: Network device 'eth2' link is down Mon Mar 28 12:20:30 2016 daemon.notice netifd: Interface 'wan6' has link connectivity loss Mon Mar 28 12:20:30 2016 daemon.notice netifd: Interface 'wan6' is now down Mon Mar 28 12:20:30 2016 daemon.notice netifd: Interface 'wan6' is disabled Mon Mar 28 12:20:30 2016 daemon.notice netifd: Interface 'wan6' is enabled Mon Mar 28 12:20:30 2016 kern.info kernel: [ 86.741137] IPv6: ADDRCONF(NETDEV_UP): eth2: link is not ready Mon Mar 28 12:20:31 2016 kern.info kernel: [ 87.697565] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:31 2016 daemon.notice vnstatd[5376]: vnStat daemon 1.12 started. (uid:0 gid:0) Mon Mar 28 12:20:31 2016 daemon.notice vnstatd[5376]: Monitoring: br-lan (100 Mbit) eth0 (100 Mbit) Mon Mar 28 12:20:31 2016 user.emerg procd: Stopping strongSwan IPsec failed: starter is not running Mon Mar 28 12:20:32 2016 daemon.notice netifd: Network device 'eth2' link is up Mon Mar 28 12:20:32 2016 daemon.notice netifd: Interface 'wan6' has link connectivity Mon Mar 28 12:20:32 2016 daemon.notice netifd: Interface 'wan6' is setting up now Mon Mar 28 12:20:32 2016 daemon.notice netifd: Interface 'wan6' is now up Mon Mar 28 12:20:32 2016 kern.notice kernel: [ 88.757682] eth2: 1000 Mbps Full duplex, port 2 Mon Mar 28 12:20:32 2016 kern.info kernel: [ 88.757709] IPv6: ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready Mon Mar 28 12:20:32 2016 user.notice firewall: Reloading firewall due to ifup of wan6 (eth2) Mon Mar 28 12:20:33 2016 user.notice ddns-scripts[5510]: myddns_ipv6: PID '5510' started at 2016-03-28 12:20 Mon Mar 28 12:20:33 2016 user.warn ddns-scripts[5510]: myddns_ipv6: Service section disabled! - TERMINATE Mon Mar 28 12:20:33 2016 user.warn ddns-scripts[5510]: myddns_ipv6: PID '5510' exit WITH ERROR '1' at 2016-03-28 12:20 Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[3307]: exiting on receipt of SIGTERM Mon Mar 28 12:20:34 2016 user.emerg procd: uci: Entry not found Mon Mar 28 12:20:34 2016 user.emerg procd: sh: 192.168.1.112: unknown operand Mon Mar 28 12:20:34 2016 user.emerg procd: cat: can't open '/etc/ITUS_DNS.tmp': No such file or directory Mon Mar 28 12:20:34 2016 user.emerg procd: rm: can't remove '/etc/ITUS_DNS.tmp': No such file or directory Mon Mar 28 12:20:34 2016 user.emerg procd: uci: Entry not found Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[5623]: started, version 2.73rc7 cachesize 150 Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[5623]: compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-DNSSEC loop-detect inotify Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[5623]: DNS service limited to local subnets Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[5623]: using local addresses only for domain lan Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[5623]: reading /tmp/resolv.conf.auto Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[5623]: using local addresses only for domain lan Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[5623]: using nameserver 192.168.1.1#53 Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[5623]: read /etc/hosts - 1 addresses Mon Mar 28 12:20:34 2016 daemon.info dnsmasq[5623]: read /tmp/hosts/dhcp - 1 addresses Mon Mar 28 12:20:36 2016 daemon.notice netifd: Interface 'blockdomain' is enabled Mon Mar 28 12:20:36 2016 daemon.notice netifd: Interface 'blockdomain' has link connectivity Mon Mar 28 12:20:36 2016 daemon.notice netifd: Interface 'blockdomain' is setting up now Mon Mar 28 12:20:36 2016 daemon.notice netifd: Interface 'blockdomain' is now up Mon Mar 28 12:20:36 2016 daemon.notice netifd: Interface 'blockdomain' is now down Mon Mar 28 12:20:36 2016 daemon.notice netifd: Interface 'blockdomain' is setting up now Mon Mar 28 12:20:36 2016 daemon.notice netifd: Interface 'blockdomain' is now up Mon Mar 28 12:20:37 2016 daemon.info dnsmasq[5623]: exiting on receipt of SIGTERM Mon Mar 28 12:20:38 2016 daemon.info dnsmasq[6044]: started, version 2.73rc7 cachesize 150 Mon Mar 28 12:20:38 2016 daemon.info dnsmasq[6044]: compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-DNSSEC loop-detect inotify Mon Mar 28 12:20:38 2016 daemon.info dnsmasq[6044]: DNS service limited to local subnets Mon Mar 28 12:20:38 2016 daemon.info dnsmasq[6044]: using local addresses only for domain lan Mon Mar 28 12:20:38 2016 daemon.info dnsmasq[6044]: reading /tmp/resolv.conf.auto Mon Mar 28 12:20:38 2016 daemon.info dnsmasq[6044]: using local addresses only for domain lan Mon Mar 28 12:20:38 2016 daemon.info dnsmasq[6044]: using nameserver 192.168.1.1#53 Mon Mar 28 12:20:38 2016 daemon.info dnsmasq[6044]: read /etc/hosts - 1 addresses Mon Mar 28 12:20:38 2016 daemon.info dnsmasq[6044]: read /tmp/hosts/dhcp - 2 addresses Mon Mar 28 12:20:38 2016 user.notice update_webfilter: updated dnsmasq blacklist Mon Mar 28 12:20:38 2016 user.notice update_webfilter: updated network.interface.blockdomain: 192.168.1.112 Mon Mar 28 12:20:38 2016 user.notice update_webfilter: updated firewall.@redirect[0].Itusfilter: 192.168.1.112 Mon Mar 28 12:20:38 2016 user.notice update_webfilter: updated firewall.@redirect[1]dns-traffic-to-shield: 192.168.1.112 Mon Mar 28 12:20:38 2016 user.notice update_webfilter: updated uhttpd.Itusfilter Mon Mar 28 12:20:44 2016 daemon.info dnsmasq[6044]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:20:44 2016 daemon.info dnsmasq[6044]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:20:44 2016 daemon.warn dnsmasq[6044]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:20:49 2016 kern.notice kernel: [ 105.747432] eth0: Link down Mon Mar 28 12:20:50 2016 daemon.notice netifd: Network device 'eth0' link is down Mon Mar 28 12:20:50 2016 daemon.notice netifd: Interface 'wan' has link connectivity loss Mon Mar 28 12:20:50 2016 daemon.notice netifd: Interface 'wan' is now down Mon Mar 28 12:20:50 2016 daemon.notice netifd: Interface 'wan' is disabled Mon Mar 28 12:20:50 2016 daemon.notice netifd: Interface 'wan' is enabled Mon Mar 28 12:20:50 2016 kern.info kernel: [ 106.741835] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready Mon Mar 28 12:20:51 2016 kern.notice kernel: [ 107.717334] eth1: Link down Mon Mar 28 12:20:52 2016 daemon.notice netifd: Network device 'eth1' link is down Mon Mar 28 12:20:52 2016 kern.info kernel: [ 108.707761] br-lan: port 1(eth1) entered disabled state Mon Mar 28 12:20:53 2016 daemon.notice netifd: Bridge 'br-lan' link is down Mon Mar 28 12:20:53 2016 daemon.notice netifd: Interface 'lan' has link connectivity loss Mon Mar 28 12:20:53 2016 daemon.notice netifd: Interface 'blockdomain' has link connectivity loss Mon Mar 28 12:20:53 2016 daemon.notice netifd: Network device 'eth0' link is up Mon Mar 28 12:20:53 2016 daemon.notice netifd: Interface 'wan' has link connectivity Mon Mar 28 12:20:53 2016 daemon.notice netifd: Interface 'wan' is setting up now Mon Mar 28 12:20:53 2016 daemon.notice netifd: Interface 'wan' is now up Mon Mar 28 12:20:53 2016 daemon.warn dnsmasq[6044]: no servers found in /tmp/resolv.conf.auto, will retry Mon Mar 28 12:20:53 2016 daemon.notice netifd: lan (5181): Received SIGTERM Mon Mar 28 12:20:53 2016 kern.notice kernel: [ 109.757795] eth0: 1000 Mbps Full duplex, port 0 Mon Mar 28 12:20:53 2016 kern.info kernel: [ 109.758833] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready Mon Mar 28 12:20:53 2016 kern.notice kernel: [ 109.787390] eth2: Link down Mon Mar 28 12:20:53 2016 user.notice firewall: Reloading firewall due to ifup of wan (eth0) Mon Mar 28 12:20:54 2016 daemon.info dnsmasq[6044]: exiting on receipt of SIGTERM Mon Mar 28 12:20:54 2016 daemon.info dnsmasq[6277]: started, version 2.73rc7 cachesize 150 Mon Mar 28 12:20:54 2016 daemon.info dnsmasq[6277]: compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP no-DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth no-DNSSEC loop-detect inotify Mon Mar 28 12:20:54 2016 daemon.info dnsmasq[6277]: DNS service limited to local subnets Mon Mar 28 12:20:54 2016 daemon.info dnsmasq[6277]: using local addresses only for domain lan Mon Mar 28 12:20:54 2016 daemon.warn dnsmasq[6277]: no servers found in /tmp/resolv.conf.auto, will retry Mon Mar 28 12:20:54 2016 daemon.info dnsmasq[6277]: read /etc/hosts - 1 addresses Mon Mar 28 12:20:54 2016 daemon.info dnsmasq[6277]: read /tmp/hosts/dhcp - 0 addresses Mon Mar 28 12:20:54 2016 user.notice ddns-scripts[6310]: myddns_ipv4: PID '6310' started at 2016-03-28 12:20 Mon Mar 28 12:20:54 2016 user.warn ddns-scripts[6310]: myddns_ipv4: Service section disabled! - TERMINATE Mon Mar 28 12:20:54 2016 user.warn ddns-scripts[6310]: myddns_ipv4: PID '6310' exit WITH ERROR '1' at 2016-03-28 12:20 Mon Mar 28 12:20:54 2016 daemon.notice netifd: Network device 'eth2' link is down Mon Mar 28 12:20:54 2016 daemon.notice netifd: Interface 'wan6' has link connectivity loss Mon Mar 28 12:20:54 2016 daemon.notice netifd: Interface 'wan6' is now down Mon Mar 28 12:20:54 2016 daemon.notice netifd: Interface 'wan6' is disabled Mon Mar 28 12:20:54 2016 daemon.notice netifd: Interface 'wan6' is enabled Mon Mar 28 12:20:54 2016 kern.info kernel: [ 110.791625] IPv6: ADDRCONF(NETDEV_UP): eth2: link is not ready Mon Mar 28 12:20:55 2016 daemon.info dnsmasq[6277]: query[A] 0.us.pool.ntp.org from 127.0.0.1 Mon Mar 28 12:20:55 2016 daemon.notice netifd: Network device 'eth1' link is up Mon Mar 28 12:20:55 2016 daemon.notice netifd: Bridge 'br-lan' link is up Mon Mar 28 12:20:55 2016 daemon.notice netifd: Interface 'lan' has link connectivity Mon Mar 28 12:20:55 2016 daemon.notice netifd: Interface 'lan' is setting up now Mon Mar 28 12:20:55 2016 daemon.notice netifd: Interface 'blockdomain' has link connectivity Mon Mar 28 12:20:55 2016 kern.notice kernel: [ 111.727682] eth1: 1000 Mbps Full duplex, port 1 Mon Mar 28 12:20:55 2016 kern.info kernel: [ 111.727718] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:55 2016 kern.info kernel: [ 111.727753] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:55 2016 daemon.notice netifd: lan (6405): udhcpc (v1.23.2) started Mon Mar 28 12:20:55 2016 daemon.notice netifd: lan (6405): Sending discover... Mon Mar 28 12:20:55 2016 daemon.notice netifd: lan (6405): Sending select for 192.168.1.59... Mon Mar 28 12:20:55 2016 daemon.notice netifd: lan (6405): Lease of 192.168.1.59 obtained, lease time 86400 Mon Mar 28 12:20:56 2016 daemon.notice netifd: Interface 'lan' is now up Mon Mar 28 12:20:56 2016 daemon.info dnsmasq[6277]: reading /tmp/resolv.conf.auto Mon Mar 28 12:20:56 2016 daemon.info dnsmasq[6277]: using local addresses only for domain lan Mon Mar 28 12:20:56 2016 daemon.info dnsmasq[6277]: using nameserver 192.168.1.1#53 Mon Mar 28 12:20:56 2016 user.notice firewall: Reloading firewall due to ifup of lan (br-lan) Mon Mar 28 12:20:57 2016 kern.info kernel: [ 113.727567] br-lan: port 1(eth1) entered forwarding state Mon Mar 28 12:20:57 2016 daemon.notice netifd: Network device 'eth2' link is up Mon Mar 28 12:20:57 2016 daemon.notice netifd: Interface 'wan6' has link connectivity Mon Mar 28 12:20:57 2016 daemon.notice netifd: Interface 'wan6' is setting up now Mon Mar 28 12:20:57 2016 daemon.notice netifd: Interface 'wan6' is now up Mon Mar 28 12:20:57 2016 kern.notice kernel: [ 113.807646] eth2: 1000 Mbps Full duplex, port 2 Mon Mar 28 12:20:57 2016 kern.info kernel: [ 113.807673] IPv6: ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready Mon Mar 28 12:20:57 2016 user.notice firewall: Reloading firewall due to ifup of wan6 (eth2) Mon Mar 28 12:20:58 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:20:58 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:20:58 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:20:58 2016 user.notice ddns-scripts[6663]: myddns_ipv6: PID '6663' started at 2016-03-28 12:20 Mon Mar 28 12:20:58 2016 user.warn ddns-scripts[6663]: myddns_ipv6: Service section disabled! - TERMINATE Mon Mar 28 12:20:58 2016 user.warn ddns-scripts[6663]: myddns_ipv6: PID '6663' exit WITH ERROR '1' at 2016-03-28 12:20 Mon Mar 28 12:21:01 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:03 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:03 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:06 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:06 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:06 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:10 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:21:10 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:21:10 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:21:11 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:11 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:11 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:16 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:16 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:16 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: [ Port Based Pattern Matching Memory ] Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: +- [ Aho-Corasick Summary ] ------------------------------------- Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Storage Format : Full Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Finite Automaton : DFA Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Alphabet Size : 256 Chars Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Sizeof State : Variable (1,2,4 bytes) Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Instances : 398 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | 1 byte states : 298 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | 2 byte states : 100 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | 4 byte states : 0 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Characters : 259324 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | States : 196495 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Transitions : 9541960 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | State Density : 19.0% Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Patterns : 22474 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Match States : 18651 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Memory (MB) : 100.60 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Patterns : 2.21 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | Match Lists : 4.02 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | DFA Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | 1 byte states : 4.16 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | 2 byte states : 90.01 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: | 4 byte states : 0.00 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: +---------------------------------------------------------------- Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: [ Number of patterns truncated to 20 bytes: 3418 ] Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: afpacket DAQ configured to inline. Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Acquiring network traffic from "eth0:eth2". Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Initializing daemon mode Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Daemon initialized, signaled parent pid: 1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Reload thread starting... Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Reload thread started, thread 0xffe5fef210 (6969) Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Checking PID path... Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: PID path stat checked out ok, PID path set to /var/snort/ Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Writing PID "4895" to file "/var/snort//snort_eth0:eth2.pid" Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: --== Initialization Complete ==-- Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: ,,_ -*> Snort! <*- Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: o" )~ Version 2.9.7.2 GRE (Build 177) Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: '''' By Martin Roesch & The Snort Team: http://www.snort.org/contact#team Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Copyright (C) 1998-2013 Sourcefire, Inc., et al. Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Using libpcap version 1.5.3 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Using PCRE version: 8.36 2014-09-26 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Using ZLIB version: 1.2.8 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Rules Engine: SF_SNORT_DETECTION_ENGINE Version 2.4 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_FTPTELNET Version 1.2 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_SDF Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_IMAP Version 1.0 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_DNP3 Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_SMTP Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_SSLPP Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_DCERPC2 Version 1.0 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_REPUTATION Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_POP Version 1.0 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_SIP Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_DNS Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_MODBUS Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_SSH Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Preprocessor Object: SF_GTP Version 1.1 Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Commencing packet processing (pid=4895) Mon Mar 28 12:21:17 2016 daemon.notice snort[4895]: Decoding Ethernet Mon Mar 28 12:21:17 2016 kern.info kernel: [ 134.027577] device eth2 entered promiscuous mode Mon Mar 28 12:21:18 2016 kern.info kernel: [ 134.167577] device eth0 entered promiscuous mode Mon Mar 28 12:21:21 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:21 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:21 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:24 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:21:24 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:21:24 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:21:26 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:26 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:26 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:31 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:31 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:31 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:36 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:36 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:36 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:39 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:21:39 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:21:39 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:21:41 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:41 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:41 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:46 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:46 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:46 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:46 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:21:46 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:21:46 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:21:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:51 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:51 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:56 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:56 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:21:56 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:21:56 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:21:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:01 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:01 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:01 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:04 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:22:04 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:22:04 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:22:06 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:06 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:06 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:11 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:11 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:11 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:16 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:16 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:16 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:16 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:22:16 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:22:16 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:22:21 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:21 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:21 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:26 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:26 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:26 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:29 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:22:29 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:22:29 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:22:31 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:31 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:31 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:36 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:36 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:36 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:41 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:41 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:41 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:42 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:22:42 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:22:42 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:22:46 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:46 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:46 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:50 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:22:50 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:22:50 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:22:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:51 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:56 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:22:56 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:22:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:22:57 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:22:57 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:22:57 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:23:01 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:01 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:01 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:02 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:23:02 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:23:02 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:23:06 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:06 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:06 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:11 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:11 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:11 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:15 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:23:15 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:23:15 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:23:16 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:16 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:16 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:21 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:21 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:21 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:26 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:26 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:26 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:31 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:31 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:31 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:23:31 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:23:31 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:23:31 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:32 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:32 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:32 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:36 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:36 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:36 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:37 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:37 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:37 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:41 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:41 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:41 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:42 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:42 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:42 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:46 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:46 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:46 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:47 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:23:47 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:23:47 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:23:47 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:47 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:47 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:51 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:52 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:52 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:52 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:56 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:56 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:57 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:23:57 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:23:57 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:23:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:01 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:01 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:01 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:02 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:02 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:02 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:04 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:24:04 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:24:04 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:24:06 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:06 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:06 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:07 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:07 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:07 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:10 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:24:10 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:24:10 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:24:11 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:11 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:11 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:12 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:12 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:12 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:16 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:16 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:16 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:16 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:24:16 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:24:16 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:24:17 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:17 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:17 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:21 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:21 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:21 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:22 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:22 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:22 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:23 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:24:23 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:24:23 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:24:26 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:26 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:26 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:27 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:27 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:27 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:29 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:24:29 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:24:29 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:24:31 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:31 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:31 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:32 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:32 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:32 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:36 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:36 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:36 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:37 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:37 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:37 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:41 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:41 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:41 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:24:41 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:24:41 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:24:41 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:42 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:42 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:42 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:45 2016 daemon.info dnsmasq[6277]: query[A] upgrade.meshare.com from 192.168.1.118 Mon Mar 28 12:24:45 2016 daemon.info dnsmasq[6277]: forwarded upgrade.meshare.com to 192.168.1.1 Mon Mar 28 12:24:45 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: upgrade.meshare.com Mon Mar 28 12:24:46 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:46 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:46 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:47 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:24:47 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:24:47 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:24:47 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:47 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:47 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:51 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:52 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:52 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:52 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:56 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:56 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:57 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:24:57 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:24:57 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: openapi.meshare.com Mon Mar 28 12:24:57 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:24:57 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:24:57 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:24:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:01 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:01 2016 daemon.warn dnsmasq[6277]: possible DNS-rebind attack detected: yourhost.example.com Mon Mar 28 12:25:01 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:02 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:02 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:03 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:25:03 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:25:06 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:06 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:07 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:08 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:08 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:11 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:11 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:12 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:12 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:16 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:16 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:17 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:17 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:18 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:25:18 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:25:21 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:21 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:22 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:22 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:26 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:26 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:27 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:27 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:31 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:31 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:31 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:25:31 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:25:32 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:32 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:36 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:36 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:37 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:37 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:41 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:41 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:42 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:42 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:46 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:46 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:47 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:47 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:51 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:25:51 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:25:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:52 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:52 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:56 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:25:56 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:25:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:56 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:57 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:25:57 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:25:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:01 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:01 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:02 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:02 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:06 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:06 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:07 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:07 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:11 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:11 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:11 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:26:11 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:26:12 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:12 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:16 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:16 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:18 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:18 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:18 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:18 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:21 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:21 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:22 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:22 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:26 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:26 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:27 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:26:27 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:26:27 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:27 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:31 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:31 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:32 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:32 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:36 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:36 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:37 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:37 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:38 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:26:38 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:26:41 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:41 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:42 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:42 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:46 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:46 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:47 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:47 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:52 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:52 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:56 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:57 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:26:57 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:26:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:00 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:27:00 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:27:01 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:01 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:02 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:02 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:06 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:06 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:07 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:07 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:11 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:11 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:12 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:12 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:16 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:16 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:17 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:17 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:20 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:27:20 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:27:21 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:21 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:22 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:22 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:26 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:26 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:27 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:27 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:31 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:31 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:27:31 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:27:31 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:32 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:32 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:36 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:36 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:37 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:37 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:41 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:41 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:42 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:42 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:43 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:27:43 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:27:46 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:46 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:47 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:47 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:53 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:53 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:53 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:53 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:55 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:27:55 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:27:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:56 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:57 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:27:57 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:27:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:01 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:01 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:02 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:02 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:06 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:06 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:07 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:08 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:08 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:10 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:28:10 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:28:11 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:11 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:12 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:12 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:16 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:16 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:16 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:28:16 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:28:17 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:17 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:21 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:21 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:22 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:22 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:26 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:26 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:27 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:27 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:28 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:28:28 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:28:31 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:31 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:32 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:32 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:36 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:36 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:37 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:37 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:41 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:28:41 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:28:41 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:41 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:42 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:42 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:46 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:46 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:47 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:47 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:52 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:52 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:55 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:28:55 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:28:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:56 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:57 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:28:57 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:28:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:01 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:01 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:01 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:02 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:02 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:02 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:06 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:06 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:06 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:07 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:07 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:07 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:11 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:11 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:11 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:12 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:12 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:12 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:16 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:16 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:16 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:17 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:17 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:17 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:20 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:29:20 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:29:21 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:21 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:21 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:22 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:22 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:22 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:26 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:26 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:26 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:27 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:27 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:27 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:31 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:31 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:31 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:32 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:32 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:32 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:36 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:36 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:36 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:37 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:37 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:37 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:37 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:29:37 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:29:41 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:41 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:41 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:42 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:42 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:42 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:46 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:46 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:46 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:47 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:47 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:47 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:51 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:51 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:51 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:52 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:52 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:52 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:55 2016 daemon.info dnsmasq[6277]: query[A] openapi.meshare.com from 192.168.1.118 Mon Mar 28 12:29:55 2016 daemon.info dnsmasq[6277]: forwarded openapi.meshare.com to 192.168.1.1 Mon Mar 28 12:29:56 2016 daemon.info dnsmasq[6277]: query[A] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:56 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1 Mon Mar 28 12:29:57 2016 daemon.info dnsmasq[6277]: query[AAAA] yourhost.example.com from 127.0.0.1 Mon Mar 28 12:29:57 2016 daemon.info dnsmasq[6277]: forwarded yourhost.example.com to 192.168.1.1