[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:51:25.204662 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:51:26.228665 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:51:30.077721 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:51:35.919645 172.16.0.2:42197 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49327 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x6360042E  Ack: 0xC799A4B6  Win: 0x401  TcpLen: 20

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:51:44.601634 172.16.0.2:42197 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49330 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x63600449  Ack: 0xC799A4D5  Win: 0x401  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:51:55.577949 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:51:56.020667 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:51:56.299777 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:51:56.667171 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49332 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x4D1E810D  Ack: 0xBCA4DC3F  Win: 0x3FD  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:51:57.300666 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:51:58.324669 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:52:08.151371 172.16.0.2:33385 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49337 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x2919BF74  Ack: 0xE89349A8  Win: 0x3FD  TcpLen: 20

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:52:15.985926 172.16.0.2:50927 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49339 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0xE101875D  Ack: 0x3D74F393  Win: 0x401  TcpLen: 20

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:52:16.150587 :: -> ff02::1:ff07:7d0c
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:52:16.506668 :: -> ff02::1:ff97:4b80
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:52:17.889312 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:52:17.889313 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:52:21.893539 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:52:21.893574 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:52:22.721679 172.16.0.2:33385 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49340 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x2919BF8F  Ack: 0xE89349C7  Win: 0x3FD  TcpLen: 20

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:52:25.892874 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:52:25.892905 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:52:27.578197 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:52:27.671961 172.16.0.2:42197 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49343 IpLen:20 DgmLen:75 DF
***AP*** Seq: 0x63600476  Ack: 0xC799A59F  Win: 0x401  TcpLen: 20

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:52:33.036385 172.16.0.2:50927 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49344 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0xE101878A  Ack: 0x3D74F46B  Win: 0x400  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:52:38.260668 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:52:40.641977 172.16.0.2:50927 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49347 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0xE10187A5  Ack: 0x3D74F48A  Win: 0x400  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:52:56.078465 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:52:59.872075 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:52:59.991172 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:00.140918 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:01.338773 :: -> ff02::1:ff97:4b80
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:01.978643 :: -> ff02::1:ff07:7d0c
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:02.428600 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:02.889900 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:03.005090 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:03.444666 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:04.468669 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:05.216492 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:06.892613 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:06.892661 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:09.444479 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:10.300653 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:10.452666 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:10.892955 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:10.892957 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:11.476663 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:15.384747 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:53:16.506519 172.16.0.2:42197 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49354 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x636004AB  Ack: 0xC799A66F  Win: 0x401  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:17.452498 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:18.452664 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:19.476664 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:20.486703 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:25.577309 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:30.661534 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:33.350720 fe80::200:ff:feaa:2b -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:56

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:33.484670 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:34.516672 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:35.540672 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:35.755869 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:40.857021 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:45.947894 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:46.266704 :: -> ff02::1:ff07:7d0c
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:46.330718 :: -> ff02::1:ff97:4b80
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:47.889878 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:47.889879 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:51.016771 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:51.893385 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:51.893430 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:55.892737 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:53:55.892738 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:53:56.096824 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:01.187254 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:05.583214 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:06.327535 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:06.612662 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:07.636679 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:11.431252 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:16.535099 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:54:18.613058 172.16.0.2:42197 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49367 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x636004D8  Ack: 0xC799A739  Win: 0x400  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:21.632687 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:26.724592 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:54:31.246750 :: -> ff02::1:ff97:4b80
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:54:31.354774 :: -> ff02::1:ff07:7d0c
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:31.815970 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:54:32.889684 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:54:32.889685 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:54:36.892923 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:54:36.892962 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:36.916646 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:54:39.822203 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49370 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x4D1E815E  Ack: 0xBCA4DE26  Win: 0x3FD  TcpLen: 20

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:54:40.893315 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-13:54:40.893321 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:41.994569 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:54:45.783634 172.16.0.2:33385 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49373 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x2919BFCE  Ack: 0xE8934BB6  Win: 0x3FD  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:47.096450 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:54:50.636353 172.16.0.2:50927 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49374 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0xE10187E4  Ack: 0x3D74F61B  Win: 0x400  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:52.168702 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:54:57.240642 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:55:01.233390 172.16.0.2:33385 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49377 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x2919BFFB  Ack: 0xE8934CBD  Win: 0x3FD  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:02.329286 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:02.459338 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:07.648766 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:11.709684 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:55:12.483358 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49381 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x4D1E818B  Ack: 0xBCA4DEDD  Win: 0x3FD  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:12.724664 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:12.727821 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:13.748672 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:17.816905 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:18.725547 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:19.732664 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:20.756671 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:22.892565 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:55:26.180629 172.16.0.2:50927 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49384 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0xE10187FF  Ack: 0x3D74F63A  Win: 0x400  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:26.733615 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:27.764661 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:27.992583 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:28.788662 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:55:31.902432 172.16.0.2:50927 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49386 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0xE101882C  Ack: 0x3D74F712  Win: 0x400  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:33.060534 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:38.140746 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:42.765836 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:43.225505 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:43.796669 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:44.820664 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:48.308955 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:53.415166 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:55:58.482002 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:03.576695 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:08.655878 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:13.764576 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:14.862005 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:15.892668 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:56:15.723420 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49395 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x4D1E81B8  Ack: 0xBCA4DF94  Win: 0x3FD  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:16.916676 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:18.844928 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:23.945411 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:29.024684 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:34.125125 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:39.219888 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:44.296468 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:49.387854 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:54.472172 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:56:59.547924 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:04.664299 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:04.787460 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:09.960865 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:57:11.183846 172.16.0.2:50927 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49405 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0xE1018859  Ack: 0x3D74F7EA  Win: 0x400  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:15.038945 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:20.131947 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:20.990659 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:22.004673 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:23.028664 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:25.232588 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:28.006624 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:57:28.192873 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49409 IpLen:20 DgmLen:75 DF
***AP*** Seq: 0x4D1E81E5  Ack: 0xBCA4E04B  Win: 0x3FD  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:29.016667 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:30.036679 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:30.320901 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:35.404670 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:36.014649 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:37.044664 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:57:37.265065 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49410 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x4D1E8208  Ack: 0xBCA4E070  Win: 0x3FC  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:38.072663 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:40.497147 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:45.584962 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:50.684150 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:52.046787 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:53.076667 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:54.100665 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:57:55.759969 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:00.832806 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:05.911892 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:10.999882 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:16.105018 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:58:17.615527 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49419 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x4D1E8235  Ack: 0xBCA4E127  Win: 0x402  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:21.180739 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:24.143030 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:25.172660 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:26.196668 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:26.260181 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:31.344513 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:36.440880 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:41.523935 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:46.599900 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:51.672569 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:58:56.756564 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:01.869012 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:06.960707 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:07.083641 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:12.267583 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:17.348798 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:22.429264 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:27.504526 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:30.271665 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:31.284665 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:32.308667 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:32.604669 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:37.287586 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:37.696221 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:38.292667 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:39.316680 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:42.776771 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:45.295695 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:46.324664 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:47.348678 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:47.860685 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:52.937866 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-13:59:55.005527 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49436 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x4D1E8274  Ack: 0xBCA4E276  Win: 0x402  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-13:59:58.023895 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:00:00.867186 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49437 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x4D1E828F  Ack: 0xBCA4E295  Win: 0x402  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:01.327813 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:02.356675 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:03.111999 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:03.380664 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:06.566709 fe80::a874:3bff:fe0b:9b49 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:56

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:06.566743 fe80::34f2:e6ff:fe67:f361 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:56

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:08.185688 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:13.276663 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:16.218867 :: -> ff02::1:ff97:4b80
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:16.858917 :: -> ff02::1:ff07:7d0c
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:17.889358 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:17.889399 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:18.360544 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:21.893596 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:21.893598 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:23.448782 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:25.893067 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:00:25.893068 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:28.560773 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:33.424044 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:33.643867 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:34.452668 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:35.476660 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:38.753210 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:43.835803 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:48.944802 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:00:49.142221 172.16.0.2:42197 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49447 IpLen:20 DgmLen:75 DF
***AP*** Seq: 0x6360055F  Ack: 0xC799AB5A  Win: 0x400  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:54.029637 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:00:59.113019 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:01.002862 :: -> ff02::1:ff07:7d0c
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:01.946904 :: -> ff02::1:ff97:4b80
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:02.012174 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:02.971958 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:04.212000 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:05.889793 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:06.889964 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:09.316407 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:09.439276 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:09.889675 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:10.890341 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:14.612638 

[**] [112:2:1] (spp_arpspoof) Ethernet/ARP Mismatch request for Source [**]
10/17-14:01:15.971343 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:15.971343 

[**] [112:2:1] (spp_arpspoof) Ethernet/ARP Mismatch request for Source [**]
10/17-14:01:15.972749 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:15.972749 

[**] [112:2:1] (spp_arpspoof) Ethernet/ARP Mismatch request for Source [**]
10/17-14:01:15.973858 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:15.973858 

[**] [112:2:1] (spp_arpspoof) Ethernet/ARP Mismatch request for Source [**]
10/17-14:01:15.975732 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:15.975732 

[**] [112:2:1] (spp_arpspoof) Ethernet/ARP Mismatch request for Source [**]
10/17-14:01:15.976982 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:15.976982 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:22.082338 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:01:30.776209 172.16.0.2:42197 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49456 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x63600594  Ack: 0xC799AC2A  Win: 0x400  TcpLen: 20

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:01:37.142472 172.16.0.2:51683 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49457 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x4D1E82CE  Ack: 0xBCA4E3E4  Win: 0x401  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:39.552708 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:40.564666 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:41.588683 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:46.082841 :: -> ff02::1:ff97:4b80
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:46.118842 :: -> ff02::1:ff07:7d0c
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:46.568685 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:01:46.558678 172.16.0.2:33385 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49460 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x2919C082  Ack: 0xE893524C  Win: 0x402  TcpLen: 20

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:47.099925 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:47.131968 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:47.572669 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:48.596664 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:50.893280 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:50.893330 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:51.582545 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:54.576645 

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:54.892573 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:01:54.892575 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:55.608665 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:01:56.628666 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:01:58.396943 172.16.0.2:50927 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49462 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0xE10188CE  Ack: 0x3D74FBA6  Win: 0x3FF  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:03.508663 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:02:08.216237 172.16.0.2:42197 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49466 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x636005C1  Ack: 0xC799ACF4  Win: 0x3FF  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:10.608743 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:11.636670 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:12.660675 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:02:19.265333 172.16.0.2:33385 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49469 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0x2919C0AF  Ack: 0xE8935353  Win: 0x402  TcpLen: 20

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:19.582717 

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:02:28.373763 172.16.0.2:50927 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49471 IpLen:20 DgmLen:67 DF
***AP*** Seq: 0xE10188E9  Ack: 0x3D74FBC5  Win: 0x3FF  TcpLen: 20

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:02:31.866926 :: -> ff02::1:ff07:7d0c
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:02:31.962923 :: -> ff02::1:ff97:4b80
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:72

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:02:32.892235 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:02:32.988048 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:123000:0] Testing DNP3 Snort DIRECT OPERATE [**]
[Priority: 0] 
10/17-14:02:34.916678 172.16.0.2:42197 -> 192.168.0.5:20000
TCP TTL:128 TOS:0x0 ID:49473 IpLen:20 DgmLen:75 DF
***AP*** Seq: 0x636005DC  Ack: 0xC799AD13  Win: 0x3FF  TcpLen: 20

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:02:36.893527 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:02:36.893528 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:02:40.893865 fe80::c302:cd7c:8a07:7d0c -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [1:1000001:1] ICMP Flood Attack Detected [**]
[Classification: Generic ICMP event] [Priority: 3] 
10/17-14:02:40.893866 fe80::73f8:e68b:6597:4b80 -> ff02::2
IPV6-ICMP TTL:255 TOS:0x0 ID:0 IpLen:40 DgmLen:48

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:42.705012 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:43.732668 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:44.756681 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:46.582913 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:02:58.804664 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:03:20.083170 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:03:47.083357 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:03:47.188661 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:03:48.833673 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:03:49.844667 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:03:50.868666 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:03:55.849648 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:03:56.852670 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:03:57.876666 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:04:03.857610 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:04:04.888662 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:04:05.908689 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:04:19.889669 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:04:20.083577 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:04:20.916669 

[**] [112:4:1] (spp_arpspoof) Attempted ARP cache overwrite attack [**]
10/17-14:04:21.940664 

