~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~

p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p

~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~

p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p

~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~

p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p1???^g?_~mo^g~mq^l~iq^d~mq^~iq^h

~ia^1?i^q1?a^^pf?@?@y^l^bu^d<^at^m?@^a}???~@~i??0??@?@^cu?i1??hc^g~i[^

h~mk^h~ic^l^k?@1??~@?t/bin/sh'

logstat@localhost@01/09/2004 22:13:04: LOG: syslog_bufferoverflow:

Датчик NetSTAT также может работать в двух режимах. Если запустить с указанием сетевого интерфейса, то будут контролироваться проходящие через него пакеты:

#netstat -i eth0

Got UDP port unreachable

192.168.0.1 48361 -> 192.168.0.20 1

Inside tcpprobe, generating Half Open event

attacker: 192.168.0.1, attackerport: 48370, victim: 192.168.0.1, victimport:22

<response sensor="netstat@localhost" scenario="proto_30" scenario_id="201" instance_id="665"