Snort mailing list archives
Port Negation not working?
From: "Paul Melson" <pmelson () gmail com>
Date: Wed, 2 Jan 2008 16:31:40 -0500
Because of a high number of false positives caused by MIME-encoded file attachments, I have modified most of the shellcode/nop rules on one of our sensors so that they should ignore SMTP traffic. However, I have a handful of rules that still fire on SMTP traffic. Here's one example. Original rule: alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"SHELLCODE base64 x86 NOOP"; \ content:"RERERERERERERERERERERERERERERERER"; metadata:policy security-ips drop; \ classtype:shellcode-detect; sid:12801; rev:1;) Modified rule: alert ip $EXTERNAL_NET any -> $HOME_NET !25 (msg:"SHELLCODE base64 x86 NOOP"; \ content:"RERERERERERERERERERERERERERERERER"; metadata:policy security-ips drop; \ classtype:shellcode-detect; sid:12801; rev:1;) I still get alerts from the modified rule for SMTP traffic containing the "RERERE..." string. I know that the rule/port syntax has been modified in 2.8 to allow port lists, but according to the manual[1], this syntax should still work for port negation. Am I missing something? Thanks, PaulM [1] http://www.snort.org/docs/snort_htmanuals/htmanual_280/node169.html ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Port Negation not working? Paul Melson (Jan 02)
- Re: Port Negation not working? Todd Wease (Jan 02)
- Re: Port Negation not working? Todd Wease (Jan 03)
- Re: Port Negation not working? Todd Wease (Jan 02)