Snort mailing list archives
RE: proper usage of $SHELLCODE_PORTS ?
From: "larosa, vjay" <larosa_vjay () emc com>
Date: Sun, 21 Apr 2002 21:58:06 -0400
Correct me if I am wrong but I think this would be the syntax, var SHELLCODE_PORTS ![80,9100,119] Can anybody provide confirmation? vjl -----Original Message----- From: Jon Hart [mailto:jhart () ccs neu edu] Sent: Sunday, April 21, 2002 5:40 PM To: snort-users () lists sourceforge net Subject: [Snort-users] proper usage of $SHELLCODE_PORTS ? Good afternoon, After upgrading to 1.8.6 a few weeks ago, I've really come to love the SHELLCODE_PORTS variable that was tossed into the ruleset. Since the default of "!80" still leaves a ton of false positives for me (yay NFS!), I've tried to axe out some troublesome ports by using the following directive: var SHELLCODE_PORTS !80 and !515 and !9100 and !119 Whether or not that declaration is correct for $SHELLCODE_PORTS is not clean to me, but snort seems to parse it just fine. Unfortunately, I just noticed a bunch of x86 NOOPS get detected on port 119, so I'm starting to think that my declaration is incorrect. I've seen examples where people look for potential shellcode on specific ports, but I want to listen everywhere and ignore the heavy talkers. I've tried setting SHELLCODE_PORTS like I do some of the the other variables I've got, but that doesn't seem to work. i.e., the following host declaration works: var HOME_NET [a.b.c.0/24,a.b.d.0/24,a.b.e.0/24] var NOT_HOME_NET !HOME_NET ...but I couldn't get something similar to work with ports. All I could find in the man page / users-guide were port ranges -- 1024:2049, 1024:, :1024 etc. Any suggestions as to how I can get this to work? Example configs would be great... thanks in advance, -jon _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 21)
- <Possible follow-ups>
- RE: proper usage of $SHELLCODE_PORTS ? larosa, vjay (Apr 21)
- Re: proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 21)
- Message not available
- Re: proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 22)
- Re: proper usage of $SHELLCODE_PORTS ? Jon Hart (Apr 21)
- Re: proper usage of $SHELLCODE_PORTS ? Martin Roesch (Apr 22)
- RE: proper usage of $SHELLCODE_PORTS ? larosa, vjay (Apr 22)