Re: pass rules for one alert

[Matt Kettler <mkettler () evi-inc com>]

That pass rule (if run with snort -o) will cause all ftp command channel 
data that is in a single packet >100 bytes to be completely ignored.

My suggestion is just disable the rule that's causing your false alarm 
problem by commenting it out with a #.

At 07:39 AM 9/2/2002 -0400, Night-Stalker wrote:
> Hello everybody,
>
> I have a simple question:
> I want to ignore exactly one rule, that triggers false positives from one 
> host to another. To do so, I wrote an pass-rule like that:
>
> pass tcp <source-ip> any -> <dest-ip> 21 (msg:"FTP command overflow 
> attempt"; flags:A+; dsize:>100; reference:bugtraq,4638; 
> classtype:protocol-command-decode; sid:1748; rev:3;)
>
> I don't want to ignore all FTP-Data between these hosts, only the FTP-Data 
> that triggers this alert (thats means the pass-rule:
> pass tcp <source-ip> any -> <dest-ip> 21
> isn't precise enough. And ignores all FTP-Data.)
>
> Is it possible to ignore exactly the FTP-Data between these Hosts, that 
> triggers that alert. I want the other FTP-Data between these Hosts being 
> scanned for other FTP-Exploits except the "FTP command overflow attempt".
>
> System: Debian 3.0 x86, snort 1.8.7, ACID, MySQL
> Snort-Options: snort -c /my/way/to/snort.conf -d -D -e -g snortgroup -i 
> eth0 -o -u snortuser
> Interface: eth0, no IP-Address
>
>
> Thanks
>
> Addy
>
> __________________________________________________________________
> The NEW Netscape 7.0 browser is now available. Upgrade now! 
> http://channels.netscape.com/ns/browsers/download.jsp
>
> Get your own FREE, personal Netscape Mail account today at 
> http://webmail.netscape.com/
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by: OSDN - Tired of that same old
> cell phone?  Get a new here for FREE!
> https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users