Re: snort rule

[pearl carlo <pearlcarlo () yahoo com>]

i second Nigel's opinion.
this is not the forum to ask question rather this is the forum to discuss solutions  to the problem. one must try first 
then if something donot work then this forum plays a good role.
pearl

Nigel Houghton <nigel () sourcefire com> wrote: On 8/29/07 4:42 AM, "lokesh sharma"  wrote:

> can you help me
>
> to write rules regarding DHCP
>
> The rule is
>
> "detect all attempts to exploit this vulnerability. In particular, it should
> detect attempts by any computer making DHCP requests where hte Hlen field has
> an invalid value, and where the following byte-code sequence is found anywhere
> in the Sname or File fields. The byte-code sequence should not be matched in
> any other field of the request. The byte-code sequence (in hexadecimal) is:
>
> 01 48 23 87 AB 1F FA 2C 9A 00 00 00 00 21 FF FF
>
> on detecction of such attack attempts, your rule should generate an alert with
> the message:
>
> "DHCP Service invalid input HLen attack detected".
>
> thanx

This looks like a question taken straight from an education course of some
kind. This is not the place to have other people do your homework for you.

-- 
Nigel Houghton
Office Linebacker
SF VRT


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


       
---------------------------------
Moody friends. Drama queens. Your life? Nope! - their life, your story.
 Play Sims Stories at Yahoo! Games.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users