Snort mailing list archives
Ramen worm and Snort log entry
From: Subba Rao <subba9 () home com>
Date: Sun, 17 Jun 2001 07:59:56 +0000
I have the following rules in my snort.conf and max-vision.conf, that should enter a log entry into the "alerts" file for a Ramen worm probe. ==================================================================== alert TCP $EXTERNAL 27374 -> $INTERNAL any (msg: "IDS485/trojan-active-subseven 22"; flags: A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids,485;) alert TCP $EXTERNAL any -> $INTERNAL 27374 (msg: "IDS460/worm-ramen-asp-retriev al-incoming"; flags: A+; content: "GET "; depth: 8; nocase;) alert TCP $INTERNAL any -> $EXTERNAL 27374 (msg: "IDS461/worm-ramen-asp-retriev al-outgoing"; flags: A+; content: "GET "; depth: 8; nocase;) alert TCP $EXTERNAL 27374 -> $INTERNAL any (msg: "IDS279/trojan-active-subseven 21"; flags: SA; reference:arachnids,279;) alert tcp $INTERNAL any -> $EXTERNAL 27374 (msg: "IDS461 - Ramen worm outgoing"; flags: PA; content: "GET "; depth: 8; nocase;) alert tcp $EXTERNAL any -> $INTERNAL 27374 (msg: "IDS460 - Ramen worm incoming"; flags: PA; content: "GET "; depth: 8; nocase;) ==================================================================== I am also running tcpdump seperately to watch the traffic inbound and outbound. The tcpdump logs and syslogs (ipchains entries) show quite a few probes for the Ramen trojan. The Snort logs do not have any entries in the "alert" or "portscan.log" files. The following are the preprocessors in the snort.conf file. I have changed the IP addresses of the systems/network here. ==================================================================== var INTERNAL 192.168.1.0/24 var EXTERNAL !$INTERNAL var DNS_SERVERS 192.168.1.5/24 preprocessor http_decode: 80 8080 preprocessor minfrag: 128 preprocessor portscan: 1.1.1.1/2 5 3 portscan.log preprocessor portscan-ignorehosts: 192.168.1.0/24 #include /usr/security/snort/etc/snort-vision.conf output alert_full: alert ==================================================================== Why is Snort not logging any information about these trojan related alerts? Thank you in advance for any help. -- Subba Rao subba9 () home com http://members.home.net/subba9/ GPG public key ID 27FC9217 Key fingerprint = 2B4C 498E 1860 5A2B 6570 5852 7527 882A 27FC 9217 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Ramen worm and Snort log entry Subba Rao (Jun 17)
- Re: Ramen worm and Snort log entry Brian Caswell (Jun 17)
- Re: Ramen worm and Snort log entry Subba Rao (Jun 17)
- Re: Ramen worm and Snort log entry Brian Caswell (Jun 17)