Snort mailing list archives
Re: Help with pass rule
From: sekure <sekure () gmail com>
Date: Wed, 1 Sep 2004 14:15:49 -0400
Carlton, A better solution would be to add the following to your threshold.conf: suppress gen_id 1, sig_id 2405, track by_src, ip 160.214.186.9 That way only THAT particular rule will be ignored, but the rest of the traffic between those hosts on those ports will still be analyzed for OTHER exploits.. Read up on suppress and threshold. They offer a much more precise way to deal with unwanted alerts without compromising the visibility into your network. ----- Original Message ----- From: Carlton L. Whitmore <cwhitmore () advocacyinc org> Date: Wed, 1 Sep 2004 11:48:18 -0500 Subject: [Snort-users] Help with pass rule To: snort-users () lists sourceforge net Joel was nice enough to help me with this rule, but it doesn't seem to be blocking the notifications. I put it in the local.rules file and made sure that rule is active in the snort.conf file. I also restarted the snort service. What else do I need to do? ( I'm trying to block these false notifications that are originating from the server 160.214.186.9 to any client ) (here is the notification) EVENT LOG Application EVENT TYPE Information SOURCE snort EVENT ID 1 COMPUTERNAME PE1300 TIME 9/1/2004 11:42:02 AM MESSAGE [1:2404:5] NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt [Classification: Attempted Administrator Privilege Gain] [Priority: 1]: {TCP} 160.214.186.9:2636 -> 160.214.186.45:445 (here is the rule Joel provided) pass tcp 160.214.186.9 any -> $HOME_NET 137:445 (msg:"netbios pass servertoclient";) ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- help with pass rule Scott Elgram (Jul 01)
- Re: help with pass rule sekure (Jul 01)
- Re: help with pass rule Scott Elgram (Jul 01)
- Re: help with pass rule sekure (Jul 01)
- Re: help with pass rule Scott Elgram (Jul 01)
- Re: help with pass rule Scott Elgram (Jul 01)
- Re: help with pass rule sekure (Jul 01)
- Re: help with pass rule Keith W. McCammon (Jul 01)
- <Possible follow-ups>
- Help with pass rule Carlton L. Whitmore (Sep 01)
- Re: Help with pass rule sekure (Sep 01)
- Re: Help with pass rule prabu (Sep 01)
- Re: Help with pass rule sekure (Sep 02)
- Re: Help with pass rule prabu (Sep 02)
- Re: Help with pass rule sekure (Sep 03)
- E-mail alerting Carlos M Ospina (Sep 03)
- Re: E-mail alerting Keith W. McCammon (Sep 03)
- Re: E-mail alerting prabu (Sep 03)
- RE: E-mail alerting Andy (Sep 12)
- Re: E-mail alerting prabu (Sep 13)
- RE: E-mail alerting Andy (Sep 18)
- Re: Help with pass rule sekure (Sep 01)