Re: threshold.conf not working?

[Miguel Alvarez <miguellvrz9 () gmail com>]

On Mon, Sep 10, 2012 at 7:09 PM, James Lay <jlay () slave-tothe-box net> wrote:
> On 2012-09-10 11:01, Miguel Alvarez wrote:
> > I noticed today that I had received over 25000 '[125:6:1] ftp_pp: FTP
> > response length overflow' alerts but I have an existing entry in my
> > threshold.conf that I thought would stop that from happening.  This
> > is
> > what I have.  Is there anything wrong with this?
> >
> > event_filter gen_id 6, sig_id 125, type limit, track by_src, count 1,
> > seconds 300
> >
> > But they were coming in multiple times per second:
> >
> > 09/10-09:45:29.334173  [**] [125:6:1] ftp_pp: FTP response length
> > overflow [**] [Classification: Attempted User Privilege Gain]
> > [Priority: 1] {TCP} 192.168.5.104:2100 -> 192.168.232.36:2765
>
> Reverse your gen and sig and you're good:
>
>
> event_filter gen_id 125, sig_id 6, type limit, track by_src, count 1,
> seconds 300

Oh yes, stupid me!  Thanks guys!

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!