Snort mailing list archives
Pass rule not working
From: "Tony Wong" <tony.wong () stanford edu>
Date: Thu, 5 Sep 2002 17:22:13 -0700
I have the following pass rules in Shellcode.rules pass tcp mysubnet/21 any -> mysubnet/21 $SHELLCODE_PORTS (msg:"SHELLCODE x86 setuid 0"; content: "|b017 cd80|"; reference:arachnids,436; classtype:system-call-det...... pass tcp mysubnet/21 any -> mysubnet/21 $SHELLCODE_PORTS (msg:"SHELLCODE x86 NOOP"; content: "|90 90 90 90 90 90 90 90 90 90 90 90 90 90|"; depth: 128; reference:$.......... pass tcp 171.64.184.0/21 any -> mysubnet/21 $SHELLCODE_PORTS (msg:"SHELLCODE x86 NOOP"; content: "|61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61|"; c$............ But I am still getting these SHELLCODE x86 alerts in ACID. Any ideas? ------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Pass rule not working Tony Wong (Sep 05)
- Re: Pass rule not working Matt Kettler (Sep 05)