Code: p387 Severity: Warning
Description: This event is generated when a host attempts to communicate with a Tribal Flood Network (TFN) DDoS client. Impact: Reconnaissance. If the listed source IP is in your network, it may be a TFN attacker or it may be probing for another attacker's TFN clients. If the listed destination IP is in your network, it may be a TFN client. Corrective: Perform proper forensic analysis on the suspected compromised host to discover the means of compromise. Rebuild a confirmed compromised host. Use a packet-filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.
|
