Snort mailing list archives
Re: Different formats in rules files
From: Joel Esler <jesler () sourcefire com>
Date: Wed, 17 Jul 2013 15:10:41 -0400
Those are decoder/preprocessor rules. Snort does not ship with a default ruleset, you can find Snort's rulesets at www.snort.org/snort-rules On Wed, Jul 17, 2013 at 2:54 PM, mulhern <mulhern () gmail com> wrote:
From decoder.rules (first line): alert ( msg:"DECODE_NOT_IPV4_DGRAM"; sid:1; gid:116; rev:1; metadata:rule-ty pe decode; classtype:protocol-command-decode;) From sensitive-data.rules (first line): alert tcp $HOME_NET any -> $EXTERNAL_NET [80,20,25,143,110] (msg:"SENSITIVE- DATA U.S. Phone Numbers"; metadata:service http, service smtp, service ftp-d ata, service imap, service pop3; sd_pattern:20,(\d{3}) ?\d{3}-\d{4}; classty pe:sdf; sid:6; gid:138; rev:1;) Both are in current Snort distribution: 2.9.4.6. - mulhern On Wed, Jul 17, 2013 at 12:27 PM, Joel Esler <jesler () sourcefire com>wrote:Please post the full rules. On Wed, Jul 17, 2013 at 12:22 PM, mulhern <mulhern () gmail com> wrote:Hi! The current Snort distribution includes only three .rules files, but two of them have a strange format that I don't see in the manual, as: alert { msg: ...and so forth as opposed to: alert tcp any any -> ...and so forth What's going on there? Thanks! - mulhern ------------------------------------------------------------------------------ See everything from the browser to the database with AppDynamics Get end-to-end visibility with application monitoring from AppDynamics Isolate bottlenecks and diagnose root cause in seconds. Start your free trial of AppDynamics Pro today! http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!-- Joel Esler Senior Research Engineer, VRT OpenSource Community Manager Sourcefire
-- Joel Esler Senior Research Engineer, VRT OpenSource Community Manager Sourcefire
------------------------------------------------------------------------------ See everything from the browser to the database with AppDynamics Get end-to-end visibility with application monitoring from AppDynamics Isolate bottlenecks and diagnose root cause in seconds. Start your free trial of AppDynamics Pro today! http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Different formats in rules files mulhern (Jul 17)
- Re: Different formats in rules files Joel Esler (Jul 17)
- Re: Different formats in rules files mulhern (Jul 17)
- Re: Different formats in rules files Joel Esler (Jul 17)
- Re: Different formats in rules files mulhern (Jul 17)
- Re: Different formats in rules files Joel Esler (Jul 17)