RE: Test question

[Ryan Russell <ryan () securityfocus com>]

On Mon, 17 Dec 2001, Ronneil Camara wrote:

> For me, I really appreciate seeing stuff in rules like content:"|ffff
> ff2f 4249 4e2f 5348 00|". How the hell did that guy come up
> with this rule!?! :-)

That's machine code from a particular exploit.  I was likely pulled off
the wire using a sniffer of some kind, or taken from the source code for
the exploit.  Many of the rules were done using a sniffer.  Developing a
rule like this is a tradeoff.  The above rule is probably fairly specific,
in that it will watch for a particular exploit, and tend to not have a lot
of false positives.  On the other hand, it's specific to that exploit, so
that if someone else write a different exploit, this rule may not catch
it, even though it's exploiting the same hole.

                                        Ryan


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users