Snort mailing list archives
latest win32 binary of snort
From: "Tom H" <tom () scriptsupport co uk>
Date: Mon, 14 Jul 2003 21:51:21 +0100
Hi, I've got the latest win32 binary for snort along with the current ruleset. "C:\Snort\bin>snort -V -*> Snort! <*- Version 2.0.0-ODBC-MySQL-WIN32 (Build 72)" and snort rules stable from "Mon Jul 14 20:19:07 2003 GMT Works for 1.9.x " I'm having difficulty getting the 'established' rule to work for the 'flow' keyword. The current porn.rules file contains; alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"PORN freeXXX"; content:"FREEXXX"; nocase; flow:to_client,established; classtype:kickass-porn; sid:1310; rev:5;) however if I remove the established, then the rule alerts for pages containing FREEXXX? can anyone point me in the right direction to what might be causing that. The init output is posted below; Cheers Tom H Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file C:\snort\etc\snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: ACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 Using LOCAL time Conversation Config: KeepStats: 0 Conv Count: 3000 Timeout : 60 Alert Odd?: 0 Allowed IP Protocols: All Portscan2 config: log: C:\snort\log/scan.log scanners_max: 256 targets_max: 1024 target_limit: 5 port_limit: 20 timeout: 60 21 Snort rules read... 21 Option Chains linked into 1 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->activation->dynamic->alert->pass->log --== Initialization Complete ==-- ------------------------------------------------------- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps1 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- latest win32 binary of snort Tom H (Jul 14)