Re: Rules not matching, or matching without logic

[Jeff Kell <jeff-kell () utc edu>]

Vanja Hrustic wrote:

> eth1 interface is connected to Catalyst switch (45xx series). Port
> monitoring works fine, and I can see all kinds of traffic on eth1. eth1
> has no IP address assigned. Later on, I tried assigning an IP, but
> nothing changed.

Is the Cat4500 port set as a monitor destination?  For a 4500 you need a monitor session setup properly, and you need 
to insure that the session includes the traffic you are trying to snort.  Typically this is the switch uplink.  For 
example, if your uplink is on gig1/1 and your eth1 is connected to gig2/24, you need something like:

> monitor session 1 source interface Gi1/1
> monitor session 1 destination interface Gi2/21

That will get you copies of traffic over the uplink, but of course it will not see traffic between ports on the same switch unless you're monitoring an SVI or vlan that includes that traffic.  You didn't give details about your setup, but it certainly sounds like the monitor session is incorrect. 

> Same is with telnet.rules. I try to login as root on a Solaris box, and
> it nicely tells me "Not on system console". However, snort doesn't pick
> it up.

You don't have stream reassembly enabled in your configuration.  You're also using "flow:" keywords in some of your rules, 
yet your flow preprocessor configuration is commented out.  Consequently, flow: won't work.

> And no matter how many times I try to login as root to Solaris box, and
> get "not on system console" message - it doesn't get picked up.

Again, you don't have flow enabled.

> At the same time, some web traffic gets picked up, which contains
> string "WebConsole.html", and triggers the 2nd rule. Then I connect to
> port 25 on a server, and issue "expn console" - but it doesn't get
> picked up. Nor logging as user 'console' on a telnet port gets picked
> up.

The 2nd rule doesn't use flow.  And you typing 'console' during a telnet session won't be reassembled, so it won't be 
seen in one contiguous packet.

Jeff 


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users