Re: Question on port lists and negation

[Jason <security () brvenik com>]

Richard Bejtlich wrote:
> On 10/8/07, Matthew Watchinski <mwatchinski () sourcefire com> wrote:
> > Richard Bejtlich wrote:
> > > Say I create this snort.conf:
> > >
> > > portvar MY_HTTP_PORTS [80,81,82,83,88,8000,8008,8080]
> > > alert tcp any any -> any !$MY_HTTP_PORTS (msg:"Example Not"; sid:4;)
> > It alerts because
> >
> > 192.168.2.105:50970 -> 192.168.2.103:8000
> > is no different than
> > 192.168.2.103:8000 -> 192.168.2.105:50970
> >
> > cause you are running with any any -> any !PORTS
> >
> > any any matches both 192.168.2.105:50970 -> 192.168.2.103:8000
> > and 192.168.2.103:8000 -> 192.168.2.105:50970
>
> Hi Matt,
>
> Thanks for your comments.  I don't understand why these packets are
> "no different".  The MY_HTTP_PORTS variable includes 8000.  If I
> negate MY_HTTP_PORTS in my rule, why do I get an alert on
> 192.168.2.105:50970 -> 192.168.2.103:8000?  Is it because port 8000 in
> the packet is not other ports in the variable, like 80, 81, etc.?

NOTE: I've not had a chance to look at the code, I could be wrong,
please verify.

I think there may two issues working together.

1) not(80 and 81 and 82...) is different than (not 81 and not 81...)
2) not(80 and 81 and 82...) will always be true

I would expect the same behavior if you ran

$ nc -v 192.168.2.103 8001

as the command you are testing

$ nc -v 192.168.2.103 8000

because

not (80 and 81 and 82 and 83 and 88 and 8000 and 8008 and 8080) is
always true, it is not possible for a single port to be both 81 and 82
and thus when you negate the negative you get a positive.

Same rules apply when dealing with ip addresses IIRC.

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users