Re: rule does not alert from nmap

[Matt Kettler <mkettler () evi-inc com>]

repniksz () aviva co hu wrote:
> Hi,
> I've written a very simply rule:
>
> alert tcp any any -> any 80 (msg: "SYN on 80 port" ; flags: S; )
>
> I've started testing, first of all i used just a simply browser to get a
> page from there, and the rule was working.
> But after i've tried use Nmap in some way:
>
> nmap -sS -P0 -p 80 195.xxx.xxx.xxx
> nmap -P0 -p 80 195.xxx.xxx.xxx
> nmap -s-sacnflags syn -P0 -p 80 195.xxx.xxx.xxx
>
> All of them sent a SYN to the 80 port.
> I've checked with ethereal.
> But there was not any on the alert file.
> what's wrong?

If you are using the stream4 preprocessor, you need "flow:stateless" in order to
detect this.


Stream4 will suppress any tcp packets that don't wind up creating a successful
tcp connection from being sent to normal rules. nmap -sS only sends a syn, so
stream4 will suppress that packet from being scanned by ordinary rules. This is
done to reduce overhead from pointless scanning of packets, as most rules are
designed to examine the data content. If no connection is established, there can
be no data...

Adding "flow:stateless" will allow a rule to match any packets, even if a
connection is not established. However, you should not use this on normal rules
that are trying to look for server exploits in a session. You should only use
this for rules that need to examine packets that do not result in a connection.
(great for checking for single syn packet DoS exploits, like the classic "land"
attack)








-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users