RE: Spurious Alerts?

["Finney Charles E" <FinneyCharlesE () JohnDeere com>]

Better?

# tcpdump -X -r 0429 () 1339-snort04 dmp host 216.68.188.168
12:53:37.866611 216.68.188.168.3506 > xxx.xxx.deere.com.http: P
853436861:853436872(11) ack 82427042 win 33580 [tos 0x10]
0x0000   4510 0033 0000 0000 f006 0000 d844 bca8        E..3.........D..
0x0010   xxxx xxxx xxxx 0050 32de 69bd 04e9 bca2        .+F....P2.i.....
0x0020   5018 832c 0000 0000 4b4f 526a 4b30 394b        P..,....KORjK09K
0x0030   0d0a 0d                                        ...
#                                        ...


Charles E. Finney
Corporate Computer Security
Moline, Illinois 61265

Safety?  Where is that to be found?  I must fight for my life every day! -
Ras Michael

> -----Original Message-----
> From: David Bianco [SMTP:bianco () jlab org]
> Sent: Tuesday, April 30, 2002 2:39 PM
> To:   Finney Charles E
> Cc:   'snort-users () lists sourceforge net'
> Subject:      [Snort-users] Spurious Alerts?
>
> Finney Charles E writes:
>  > Running Snort 1.8.6 on FreeBSD 4.5, Alerts on:
>  > 
>  > alert tcp $EXTERNAL_NET any -> any 80 (msg:"WEB-ATTACKS /bin/ls command
>  > attempt"; flags:A+; uricontent:"/bin/ls"; nocase; sid:1369; rev:1;
>  > classtype:web-application-attack;)
>  > The packet data as displayed in ACID is:
>  > 4B 4F 52 6A 4B 30 39 4B 0D 0A 0D
> KORjK09K...
>  > Any clues as to why SNORT would alert on the aforementioned?
>
> Unfortunately, since you didn't really include enough information for
> me to help, I can only guess.  I'd need to see the full dump of the
> packet,
> but I suppose there's a part in the data that looks like "/bin/ls", at 
> least after passing it through the HTTP decoding preprocessor.  You'd need
> to look at the rest of the packet for a better answer.
>
>       David
>
>
> -- 
> David J. Bianco, GSEC         <bianco () jlab org>
> Thomas Jefferson National Accelerator Facility
>
>      The views expressed herein are soley those of the author and
>           not those of SURA/Jefferson Lab or the US DOE.


_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: 
bandwidth@sourceforge.net_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users