No content match in modern snorts

[nard <nard () nardware co uk>]

Afternoon all.

I have noticed that some rules on my snort system are not triggering when they should. 

Simple test rig:

|client|---|snort|---|webserver|
            
The webserver has a two line text file on it containing 

foo
bar

I have three _simple_ rules on the snort system:

alert tcp any any <> any any (msg: "Debian"; content: "Debian";)
alert tcp any any <> any any (msg: "bar"; content: "bar";)
alert tcp any any <> any any (msg: "foo"; content: "foo";)

I am using wget to download a text file from the webserver to the client. When using *certain* versions of snort, the 
foo and bar rules never trigger. The Debian rule however always does (the webserver is a Debian box and the string is 
therefore in the HTTP banner). I have enabled one rule at a time, and also tried all three at the same time.

I have repeated this test with many versions of snort, and have mixed results.

Snort 1.8 (installed via apt-get on a Debian woody box) 
Debian Rule : alert is raised
foo rule: alert is raised
bar rule: alert is raised

Snort 2.0.6 (built from source on a Debian woody box)
Debian Rule : alert is raised
foo rule: alert is raised
bar rule: alert is raised

Snort 2.1.2 (Built from source on a Debian woody box)
Debian Rule: alert is raised
foo rule: *No alert*
bar rule: *No alert*

Snort 2.4 (Built from source on a Debian sarge box)
Debian Rule: alert is raised
foo rule: *No alert*
bar rule: *No alert*

Snort 2.3 (installed via apt-get on a Debian sarge box)
Debian Rule: alert is raised
foo rule: *No alert*
bar rule: *No alert*

The snort.conf on all tests is with a near vanilla config file, (the only thing changed from stock is to enable alerts 
to syslog). 
Using tethereal on the snort sensor I can see the below packet crossing the wire each time.

Ethernet II, Src: 00:0b:6a:3a:45:5a, Dst: 52:54:00:12:77:26
Internet Protocol, Src Addr: 192.168.0.59 (192.168.0.59), Dst Addr: 192.168.0.157 (192.168.0.157)
Transmission Control Protocol, Src Port: www (80), Dst Port: 1059 (1059), Seq: 1, Ack: 98, Len: 337
Hypertext Transfer Protocol
Line-based text data: text/plain

0000  52 54 00 12 77 26 00 0b 6a 3a 45 5a 08 00 45 00   RT..w&..j:EZ..E.
0010  01 85 29 53 40 00 40 06 8d f7 c0 a8 00 3b c0 a8   ..)S@.@......;..
0020  00 9d 00 50 04 23 0f 7c 21 e7 51 47 a0 ef 80 18   ...P.#.|!.QG....
0030  16 a0 bb 6e 00 00 01 01 08 0a 14 a0 08 ed 00 07   ...n............
0040  b8 03 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f   ..HTTP/1.1 200 O
0050  4b 0d 0a 44 61 74 65 3a 20 4d 6f 6e 2c 20 31 39   K..Date: Mon, 19
0060  20 53 65 70 20 32 30 30 35 20 31 36 3a 31 38 3a    Sep 2005 16:18:
0070  31 33 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20   13 GMT..Server: 
0080  41 70 61 63 68 65 2f 31 2e 33 2e 33 33 20 28 44   Apache/1.3.33 (D
0090  65 62 69 61 6e 20 47 4e 55 2f 4c 69 6e 75 78 29   ebian GNU/Linux)
00a0  20 6d 6f 64 5f 70 65 72 6c 2f 31 2e 32 39 0d 0a    mod_perl/1.29..
00b0  4c 61 73 74 2d 4d 6f 64 69 66 69 65 64 3a 20 4d   Last-Modified: M
00c0  6f 6e 2c 20 31 39 20 53 65 70 20 32 30 30 35 20   on, 19 Sep 2005 
00d0  31 35 3a 31 37 3a 32 38 20 47 4d 54 0d 0a 45 54   15:17:28 GMT..ET
00e0  61 67 3a 20 22 31 30 38 33 63 37 2d 38 2d 34 33   ag: "1083c7-8-43
00f0  32 65 64 36 38 38 22 0d 0a 41 63 63 65 70 74 2d   2ed688"..Accept-
0100  52 61 6e 67 65 73 3a 20 62 79 74 65 73 0d 0a 43   Ranges: bytes..C
0110  6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 38   ontent-Length: 8
0120  0d 0a 4b 65 65 70 2d 41 6c 69 76 65 3a 20 74 69   ..Keep-Alive: ti
0130  6d 65 6f 75 74 3d 31 35 2c 20 6d 61 78 3d 31 30   meout=15, max=10
0140  30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b   0..Connection: K
0150  65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65   eep-Alive..Conte
0160  6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c   nt-Type: text/pl
0170  61 69 6e 3b 20 63 68 61 72 73 65 74 3d 69 73 6f   ain; charset=iso
0180  2d 38 38 35 39 2d 31 0d 0a 0d 0a 66 6f 6f 0a 62   -8859-1....foo.b
0190  61 72 0a                                          ar.

Does anyone have an idea what is going or rather what I am doing wrong here!?!




-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users