Snort pattern matching weirdness.

["larosa, vjay" <larosa_vjay () emc com>]

O.Kay, I just upgraded to Snort 1.9.1 last night. Since then I have been
getting tons
of events for a couple snort rules I wrote a while back to detect the Fun
Love virus crossing
the network. Below is an example rule I wrote which is having this problem.

alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS Fun Love
flcss.exe";
flags: A+; content: "|66 6c 63 73 73 2e 65 78 65|"; classtype:string-detect;
rev:1;)

This is the payload from one of the packets that tripped this rule. I have
been getting tons of these.
Since I upgraded. I can't for the life of me figure out how the data from
this packet tripped this rule.
Does anybody have any ideas? Is anybody else seeing rules triggered even
though packet payloads
are not correctly matched in the rule that identified them? This is not the
only rule that I have that is 
doing this either, I know of a second rule that is tripping when the data
pattern does not match.
Please help!!

AC 27 DC BB F0 DE 81 EC 4B 25 84 F3 BA 04 61 D7   .'......K%....a.
C9 7A 4E 28 38 98 F3 45 91 6B 97 B8 05 C5 75 F0   .zN(8..E.k....u.
72 B5 4D 82 F5 B4 29 B7 13 EB 4C 2E DF DC 46 F6   r.M...)...L...F.
FC 0F E2 16 85 EB E4 34 97 15 5C 4F 07 F7 C5 DE   .......4..\O....
C8 ED E5 5C 2C B1 20 97 21 2D 70 1B 24 2E 2F 70   ...\,. .!-p.$./p
1B 25 AE 2A 70 B2 DF F4 33 8A FC E6 3A 82 FD E9   .%.*p...3...:...
02 77 41 C1 CD 2B B8 4B 0A 6E 41 C1 2D 2A B8 37   .wA..+.K.nA.-*.7
15 DC 95 8E 60 BF BF C0 2D 75 04 FB C2 04 EE 9D   ....`...-u......
0E BF 2F CC A3 95 FC 0B 47 8B 85 63 CC 73 10 7B   ../.....G..c.s.{
B6 CA 3E 8A 9A DD 9B 2B F7 8D 54 2C C2 42 86 E7   ..>....+..T,.B..
92 28 FF F4 D1 8A 73 32 F1 84 E3 4E 1F B5 67 8E   .(....s2...N..g.
15 0B 39 A5 0A 9E EF A2 26 7D 71 C5 F9 D3 04 AD   ..9.....&}q.....
AA 75 3B D9 AF 8E 6F A8 9C 67 B3 DC A6 06 AB A4   .u;...o..g......
43 D6 65 C3 FF 5D D0 81 5B 12 71 58 24 FE B0 AC   C.e..]..[.qX$...
5F B0 9C 92 55 A4 91 EB 99 DF 49 DE 9E F1 B4 A2   _...U.....I.....
8C 59 4C 9E EB 9D E4 C9 2D C6 15 65 5B 8B BC 3A   .YL.....-..e[..:
E5 DD 11 83 0D 7B 96 03 2E F5 FA 7E 19 7F 2F 24   ....{.....~./$
8C F3 41 63 75 33 FF 7F AF D2 3E 67 D0 07 C4 CB   ..Acu3...>g....
F4 BB 68 B8 70 FF 7F F2 3A C1 1D DF 9F 33 74 32   ..h.p..:....3t2
90 CF B9 4E DC B1 2A 4D 42 6B CF A3 26 63 FA AD   ...N..*MBk..&c..
E7 E5 73 9B E6 0B E5 79 35 1B CF 3F 2C 2F EC 41   ..s....y5..?,/.A
2B B9 03 1A 3A DB AA D4 27 5F 02 BF 9B CF 9C 12   +...:...'_......
FE 20 70 37 75 70 AB EE ED AA B0 2A F9 F3 39 E2   . p7up.....*..9.
DD AC 83 69 3A 1D 6C 92 BF F8 2C B8 2E D8 0D B2   ...i:.l...,....
CD B4 AC E0 60 03 60 33 AE 5D C1 45 15 5C B7 82   ....`.`3.].E.\..
8B 29 B8 1E 05 97 50 70 7B 14 5C 52 C1 1D 54 70   .)....Pp{.\R..Tp
69 05 37 AE E0 26 3A EB 36 9A CC 4D 09 D7 C9 F6   i.7..&:.6..M....
B0 AD E0 AA 42 9A 32 37 DB C9 D6 84 92 89 58 43   ....B.27......XC
7E 67 3A D9 9E CD 20 EE DB 9D 6C 7F 67 10 F7 5A   ~g:... ...lg..Z
4D 97 46 EE A2 E2 BA 5F 28 AE FB 95 42 CF DF 76   M.F...._(...B..v
F2 F9 61 23 F7 67 C5 75 D7 3A F9 9C A5 91 FB 8F   ..a#.g.u.:......
E2 BA D6 68 F3 32 44 A3 EC 35 BA 20 6E 6B 94 CD   ...h.2D..5. nk..
9D 83 B8 A7 A3 98 5F AC 91 3B 20 A4 29 DB FB E3   ......_..; .)...
0A EE 8B 42 7E 32 F7 D5 28 1B CF 83 B8 73 8A 34   ...B~2..(....s.4
7F 18 C5 F9 7D 00 F7 6B C5 75 57 A2 78 2F C5 1A   ...}..k.uW.x/..
B9 6B 42 9A F2 FD 19 EE AA 97 41 E6 B6 74 61 3B   .kB.......A..ta;
C4 1A B9 6D 5D 6C 2D 02 AE 93 E7 41 03 5D 75 5D   ...m]l-....A.]u]
3A 02 56 6D 59 BB 27 7C 73 E3 30 86 37 E3 BA 05   :.VmY.'|s.0.7...
6E 9D C4 6D 6B C2 F1 0D 0F 60 63 24 E7 92 BE F5   n..mk...`c$....
8B 08 86 C3 CF 7E C9 79 FF 3C DD 10 ED 3A 69 7E   .....~.y.<...:i~
68 88 EB 3A 01 5C 54 C1 75 2B B8 98 82 EB 51 70   h..:.\T.u+....Qp
09 05 B7 87 04 CF 63 0D 5C 2B 0A 9A C7 1A F8 7B   ......c\+.....{
B5 38 8F 15 B9 34 09 7E B6 1A B8 0E D8 8C 9B 50   .8...4.~.......P
70 53 0A CE 56 70 55 05 37 AB E0 4E 2B B8 B3 0A   pS..VpU.7..N+...
EE 9C 82 9B 53 70 17 14 DC BC 82 BB A4 E0 16 48   ....Sp.........H
F0 38 66 E0 BB 09 41 63 95 81 EF 06 35 E3 AE 90   .8f...Ac....5...
E0 71 CC A8 AD 83 43 3F 4A 2C B4 49 DC 3B D8 FF   .q....C?J,.I.;..
66 29 27 F7 A3 F7 79 7B 50 AE 55 E2 96 05 2E 22   f)'...y{P.U...."
71 37 04 CE 90 FB 66 A8 CE B5 C8 7D 33 C4 CA 30   q7....f....}3..0
3B 97 5C E8 94 FB 66 13 8E A7 31 8E EB AA 44 E2   ;.\...f...1...D.
E0 DE 3D 1B 69 E4 5A E9 9F 8D 21 3E 9B 61 F6 21   ..=.i.Z...!>.a.!
BC EB BD 2E C4 9E 4C 3C 0C FA 28 0B 8B D4 C2 E0   ......L<..(.....
1D EE F5 21 A6 19 0F 83 F7 B5 59 BC 96 5A 18 BC   ...!......Y..Z..
9B DD 1E 6E B4 57 57 FE 0B 60 73 DC 7C F7 E6 BB   ...n.WW..`s.|...
FC 77 67 DF 0F 94 F5 23 6C DA E8 F7 16 5A 4C BD   .wg....#l....ZL.
2D F5 36 70 BB F3 FF B0 9E FF EB F9 BF 9E FF AF   -.6p............
F9 F9 3F 3F FF 0B FA D1 A3 6F 1C EE FF C6 BF 16   ..??.....o......
0F 9C FE E9 8F BE B6 EB E2 7F DF B8 D5 F3 BF F4   ...............
F9 3F 1A 1A 6B 0B B7 7A FE 97 81 36 00 D8 C9 1F   .?..k..z...6....
23 FA FC 2F 0D 8D B5 8C 8F EB 2A D0 D0 D0 D0 D0   #../.....*.....
D0 D0 D0 D0 D0 B8 6F B0 52 FF 5F 9F 27 6C FF 2E   ......o.R._.'l..
60 5C 57 9B 86 C6 3D 81 FF 03 40 D9 1B D5 F3 23   `\W...=...@....#
00 80 43 4B EC 9D 0F 70 94 65 7E C7 DF DD 6C 20   ..CK...p.e~...l 
39 A0 2E 16 AE C1 03 6F 83 49 0C C8 9F 05 01 03   9......o.I......
82 79 43 08 26 0A B8 01 02 C1 62 D9 85 AC 24 1A   .yC.&.....b...$.
60 09 E1 06 3A D2 6E 10 7A A1 D5 36 CC C1 14 5B   `...:.n.z..6...[
B9 6E EE A0 A2 05 DD 58 39 E1 04 6F 41 81 80 44   .n.....X9..oA..D
37 40 14 14 CE C5 81 19 EC C8 4C 98 91 0E CE 48   7@........L....H
DB EF EF 7D BE 9B DD 25 9B 64 E1 EC 4D AB FB 4E   ...}...%.d..M..N
BE FB 79 B3 FB BC CF FB FC FF F7 3E EF F3 44 FC   ..y........>..D.
90 DC 07 2C 79 24 8F 1F DE FE 5F C6 21 C3 F5 C9   ...,y$...._.!...
7D C0 92 47 F2 F8 01 EE FF 75 9A FB 7F AD CB 6A   }..G.....u....j
79 EE 3F 97 14 16 3D DF 76 6A 6A F9 D7 CF 9F 4C   y.?...=.vjj....L
EE FF 95 3C 92 C7 F7 FB E8 C3 7E 7D F8 F9 FF 22   ...<......~}..."
6E F2 3D E2 5E 4D 5B C8 F7 E3 E5 19 FF E0 FB D0   n.=.^M[.........
43 A8 D4 B4 79 5A 64 FF AF 87 79 CD 44 68 12 F4   C...yZd...y.Dh..
90 A6 D6 12 9B 02 3D 02 E5 6B 6A 0E B7 2C 56 21   ......=..kj..,V!
CB AE 14 6A 6A 2E 61 11 34 1D 7A 54 53 F3 B8 4B   ...jj.a.4.zTS..K
34 75 FF C7 35 B5 5E 96 AC 2B 34 0B 7A 42 53 73   4u..5.^..+4.zBSs
10 4A A1 D9 90 8C 47 C8 1A 65 B7 CE 2F 10 3F C8   .J....G..e../.?.
FC 02 99 67 20 F3 0B EE A2 9B 65 51 06 99 97 20   ...g .....eQ... 
EF 15 C8 BC 04 99 AF 20 73 17 E4 99 A7 CC 73 97   ....... s.....s.
79 8C B2 E4 B0 EC 6D 2E 73 17 86 68 B2 1E 9D A6   y.....m.s..h....
FD 54 53 73 DD 33 35 59 1B 45 D3 E0 75 63 FE BE   .TSs.35Y.E..uc..
AC 31 90 03 DD AF A9 F9 EE C3 A0 E1 90 6C 2D 20   .1...........l- 
EF C4 CB F2 E7 B2 05 C1 68 4D CD 19 1C 03 8D 85   ........hM......
1E 84 C6 69 6A 3E ED 84 64 92 4B 1E FF 87 0E A9   ...ij>..d.K.....
BD 4F 73 FE DF AD F5 7F D8 4C 72 FF AF E4 91 3C   .Os.....Lr....<
BE 9F 47 72 FF AF E4 91 3C 7E B8 47 78 BD AE BE   ..Gr....<~.Gx...
68 F8 FA 0F 75 AE EE A3 F7 F3 1A 7A C9 E4 6F 0C   h...u......z..o.
59 4C 8F D4 05 BA 5C 89 36 38 5E D1 3A 81 EF DC   YL....\.68^.:...
B3 C1 AB 4F                                       ...O


vjl


V.Jay LaRosa                           EMC Corporation
Information Security                  4400 Computer Dr.
(508)898-7433 office                  Westboro, MA 01580
(508)353-1348 cell                     www.emc.com
888-799-9750 pager                   larosa_vjay () emc com





-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger
for complex code. Debugging C/C++ programs can leave you feeling lost and
disoriented. TotalView can help you find your way. Available on major UNIX
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users