Snort mailing list archives
detection problem in client body
From: Felix Erlacher via Snort-users <snort-users () lists snort org>
Date: Wed, 7 Mar 2018 17:55:40 +0100
Hi all, I am having a detection problem with an http_client_body rule. I tried to provide a minimal example in the attachments. post.pcapng contains two full tcp connections with one http request (and corresponding response) each. The first post request has 'foo' in the client body, the second post request has 'foo123' in the client body. test.rules contains a rule which is looking for the letter 'o' in the http_client_body. If I run snort in IDS mode, only the second post request is triggering an alert while the first post request does not although it also contains an 'o' in the client body. The only notable difference (to me) is the '123' added to the client body, which IMHO should not make any difference. Why is the first post request not triggering an alert? I am using the newest snort 2.9.11.1 with standard config (minimal changes, attached), snort output is attached. As can be seen, I am using the -k none switch. thx and regards Felix
Attachment:
test.rules
Description:
Attachment:
post.pcapng
Description:
Attachment:
snort.output
Description:
Attachment:
snort.conf
Description:
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- detection problem in client body Felix Erlacher via Snort-users (Mar 07)
- Re: detection problem in client body Russ via Snort-users (Mar 07)
- Re: detection problem in client body Felix via Snort-users (Mar 08)
- Re: detection problem in client body Joel Esler (jesler) via Snort-users (Mar 08)
- Re: detection problem in client body Kumarswamy H N (kumhn) via Snort-users (Mar 08)
- Re: detection problem in client body Felix via Snort-users (Mar 08)
- Re: detection problem in client body Felix via Snort-users (Mar 08)
- Re: detection problem in client body Russ via Snort-users (Mar 07)