RE: simple pass rules

["Aaron McKinnon" <aaron () fullerene com>]

Nope, starting it like this:

/usr/sbin/snort -Afull -u snort -g snort -d -D -i $INTERFACE -l
/var/log/snort -c /etc/snort/snort.conf

I'll try it with the -o flag and let everyone know. Thanks.

-----------------------------------
Aaron McKinnon
System Administrator
Fullerene Productions, Inc.
3250 Wilshire Blvd. Suite 2000
Los Angeles, CA 90010
213.365.1692
-----------------------------------

-----Original Message-----
From: shawn . moyer [mailto:shawn () net-connect net]
Sent: Monday, May 07, 2001 3:32 PM
To: Aaron McKinnon
Cc: snort-users
Subject: Re: [Snort-users] simple pass rules


Are you starting snort with the -o flag?


Aaron McKinnon wrote:
> Trying to write a simple pass rule:
>
> #Pass rule for uagent (ArcServe 2000 backup agent).
> pass tcp 208.158.118.3 6051 -> 208.158.118.100 any
> pass tcp 208.158.118.150 any -> 208.158.118.100 139
>
> It seems to ignore the rules in my local.rules file... Have I written
these
> rules correctly?
>
> Trying to eliminate this:
>
> [**] NETBIOS Samba clientaccess [**]
> 05/04-15:54:44.393982 208.158.118.150:2622 -> 208.158.118.100:139
> TCP TTL:64 TOS:0x0 ID:33184 IpLen:20 DgmLen:196 DF
> ***AP*** Seq: 0x42FBC312  Ack: 0x66B24302  Win: 0x7CFB  TcpLen: 32
> TCP Options (3) => NOP NOP TS: 146795697 856297
>
> and
>
> [**] EXPLOIT x86 NOOP [**]
> 05/05-00:47:09.281828 208.158.118.3:6051 -> 208.158.118.100:2080
> TCP TTL:64 TOS:0x0 ID:26854 IpLen:20 DgmLen:1500 DF
> ***A**** Seq: 0xDB2C0C8E  Ack: 0xDC26531E  Win: 0x7D78  TcpLen: 20
>
> Thanks.
>
> -----------------------------------
> Aaron McKinnon
> System Administrator
> Fullerene Productions, Inc.
> 3250 Wilshire Blvd. Suite 2000
> Los Angeles, CA 90010
> 213.365.1692
> -----------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


--

s h a w n   m o y e r
shawn () net-connect net

"May the forces of evil become
confused on the way to your house."

                    --George Carlin


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users