Re: SMTP traffic

[Jose Nazario <jose () monkey org>]

On Sun, 2 Jul 2007, bron () gmail com wrote:

> I am sort of new to IDS. I am writing rule for IPS.  If i have a rule 
> which requires monitoring the argument of Mail From : SMTP command, then 
> it may happen that my rule can get triggered inside the body of emails 
> giving me false positives.

> Any suggestions how can i remove such false positives ?

if your IDS doesn't keep track of the SMTP dialogue (IIRC NFR used to, as 
an example), you can specify a maximum search depth for the MAIL FROM 
command. alternatively, if you have to write regular expressions, you can 
enforce the MAIL FROM command coming after the HELO or EHLO command and 
before the RCPT TO command. the regex's get a bit hairy there, though.

hope that helps.

________
jose nazario, ph.d.                 jose () monkey org
http://monkey.org/~jose/            http://monkey.org/~jose/secnews.html
                                    http://www.wormblog.com/

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------