Snort mailing list archives
latest win32 binary of snort (resend with modifications to get around various filters that bounced the last message)
From: "Tom H" <tom () scriptsupport co uk>
Date: Mon, 14 Jul 2003 22:41:05 +0100
Hi, I've got the latest win32 binary for snort along with the current ruleset. "C:\Snort\bin>snort -V -*> Snort! <*- Version 2.0.0-ODBC-MySQL-WIN32 (Build 72)" and snort rules stable from "Mon Jul 14 20:19:07 2003 GMT Works for 1.9.x " I'm having difficulty getting the 'established' rule to work for the 'flow' keyword. The current 'p o r n.rules' (spaces added to fool various spam catchers) file contains; alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"P O R N freezzz"; content:"FREEZZZ"; nocase; flow:to_client,established; classtype:kickass-p o r n; sid:1310; rev:5;) however if I remove the established, then the rule alerts for pages containing FREEZZZ? can anyone point me in the right direction to what might be causing that. As I assume that web content is sent back on an established connection. The init output is posted below; Cheers Tom H Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file C:\snort\etc\snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: ACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 Using LOCAL time Conversation Config: KeepStats: 0 Conv Count: 3000 Timeout : 60 Alert Odd?: 0 Allowed IP Protocols: All Portscan2 config: log: C:\snort\log/scan.log scanners_max: 256 targets_max: 1024 target_limit: 5 port_limit: 20 timeout: 60 21 Snort rules read... 21 Option Chains linked into 1 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->activation->dynamic->alert->pass->log --== Initialization Complete ==-- ------------------------------------------------------- This SF.Net email sponsored by: Parasoft Error proof Web apps, automate testing & more. Download & eval WebKing and get a free book. www.parasoft.com/bulletproofapps1 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- latest win32 binary of snort (resend with modifications to get around various filters that bounced the last message) Tom H (Jul 14)