RE: Snort pattern matching weirdness.

["larosa, vjay" <larosa_vjay () emc com>]

Anybody know what is going on here? Marty, Chris?

Here is another example of a packet that triggered a rule
it never should have. Now this rule has been working for 
almost a year now with great accuracy. This rule was not
modified at all. The only thing that changed was the version
of snort.

(Rule for Fun Love Virus)
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS Fun Love
flcss.exe"; flags: A+; content: "|66 6c 63 73 73 2e 65 78 65|"; 
classtype:string-detect; rev:1;)

Packet that was captured by this rule.

EA C4 BF CC CC DF BF E2 8F C8 E7 EE FF FF FC FC   ................
C2 C2 3F BD 57 D5 B3 DE DE CB DE B3 D9 4B 4B 31   ..?.W........KK1
70 88 49 99 4B 3B 44 71 A4 64 D2 7D 70 BA 69 60   p.I.K;Dq.d.}p.i`
5A 33 87 9A E5 94 1A 10 C7 E6 37 E5 B3 DE 9D CB   Z3........7.....
2D B1 E5 FD E1 8B B3 00 B3 9D 0F DE B3 B2 E5 FD   -...............
FD E5 B3 B1 DE 2B 0E 0E 1A 0C 1A 0C 1A 21 12 12   .....+.......!..
07 07 09 07 15 15 15 15 14 14 09 0D 09 0D 0A 0D   .............
0A 0A 0A 03 08 08 08 05 05 05 01 01 01 04 04 04   ................
04 06 04 04 06 19 19 06 19 06 19 06 19 04 19 19   ................
19 19 0F 01 01 01 05 05 08 08 08 03 03 0A 64 01   ..............d.
19 19 05 0A 0D 14 0B 14 14 14 15 32 14 09 0D 0D   ..........2..
0D 14 14 32 32 32 32 22 32 4B 31 4B 21 28 1A 46   ..2222"2K1K!(.F
26 26 26 69 26 69 26 69 28 73 73 28 6A 73 6A 3D   &&&i&i&i(ss(jsj=
6B 6B 54 31 6B 88 8E 8E 69 69 69 72 52 36 33 33   kkT1k...iiirR633
5E 51 45 45 34 34 41 5C 40 5C 40 5C 65 87 65 86   ^QEE44A\@\@\e.e.
86 A0 A0 83 9B D6 D8 55 4B 68 5A 46 54 0F E5 B3   .......UKhZFT...
B3 CB DE 94 9D DE 68 7C A7 BF 41 5D 4F 5D 62 96   ......h|..A]O]b.
BC 86 A0 62 4F 38 38 4F 4F 38 38 4F 4E 2C 4F 44   ...bO88OO88ON,OD
EC DE 78 58 4F 62 4E 5B 44 97 CD AD D4 A7 C3 B8   ..xXObN[D.......
A4 D2 BB D0 D0 D0 D0 D0 D0 D0 D0 D0 D6 CF CF CF   ................
DB DB D3 D3 D3 DB A4 CE A3 D1 BA C6 CC A0 CC A0   ................
A0 9F 9F A7 C4 8F 8F 8C 7B 8F 7B 7B 8F 8F CA BE   ........{.{{....
25 A6 A6 6D BE FE FE BE E7 E7 E7 FE B9 D4 C4 E3   %..m............
CC DF CC CC E2 D4 C8 F6 FF FF FF FF FF FF FF FF   ................
FF FF FF FF FF FF FF FF FF FF FF FF FF FF EE C8   ................
D4 E2 DA CC DF CC CD E2 D4 BE FF FF FF FF FC FC   ................
C2 C2 65 5F D8 E1 B3 D5 E5 CB E1 B1 F9 60 4A 60   ..e_.........`J`
79 D8 22 4B 8E 72 72 51 A9 8A AB C5 C0 A4 2B 60   y."K.rrQ......+`
72 5D A3 E6 19 46 70 33 56 DE 3E D9 B1 E5 B3 E1   r]...Fp3V.>.....
FD E5 FD E5 E5 B3 B3 B3 8B 19 9D 9D B1 2D 2D B2   .............--.
FD FD E5 2D D9 1A 0E 26 0C 1A 1A 1A 21 1A 12 0B   ...-...&....!...
07 07 09 15 15 0B 14 0B 14 14 0D 09 0D 0D 0D 0A   ............
0A 0A 0A 08 08 03 08 05 05 01 01 01 0F 04 04 04   ................
04 04 19 19 06 06 06 06 06 06 06 06 06 06 06 06   ................
37 04 04 0F 04 0F 01 01 05 05 03 08 0A 03 08 0F   7...............
57 19 11 0A 0D 14 14 14 15 15 14 15 14 0D 0D 0A   W............
0D 14 32 15 32 32 15 32 22 4B 31 4B 21 46 46 46   .2.22.2"K1K!FFF
28 28 28 26 69 28 26 5B 28 28 73 73 28 46 6A 4D   (((&i(&[((ss(FjM
6B 92 31 54 A9 6B 79 79 73 69 49 A4 52 5E 35 3C   k.1T.kyysiI.R^5<
3C 67 51 45 41 45 41 5C 40 5C 40 5C 65 87 65 87   <gQEAEA\@\@\e.e.
86 86 A0 86 BF 59 C7 2B 55 60 4B 39 68 94 E5 B1   .....Y.+U`K9h...
EC E5 B3 9D E1 94 97 C3 BF 45 6E 38 4F 6E 51 82   .........En8OnQ.
BC BC 82 95 4F 4F 2F 4E 38 38 4F 2F 4F 38 4F 74   ....OO/N88O/O8Ot
D5 3E 4F 2C 4F 4F 62 95 38 A2 30 97 9F B9 AD 9E   .>O,OOb.8.0.....
4E D6 D2 D8 9A 92 D0 D0 A9 92 D6 D6 D6 D0 CF CF   N...............
B6 DB D3 A4 CE CE CE CE DC CE DC D1 87 CC A0 BF   ................
BF 9E A7 9E 9F A7 A7 8C 8F 8C 8F C8 7B 8F CA BE   ............{...
6D C8 BE E4 C8 6D C8 FE E7 F6 EA CD CA EA C3 CC   m....m..........
CC DF DF BF CD D4 C8 FE FF FF FF FF FF FF FF FF   ................
FF FF FF FF FF FF AE E7 FF FF FF FF FF FF EE E4   ................
D4 E2 CC DF DF CC CD C4 8F CA EF AE AE FF FC FC   ................
C2 C2 65 83 BA D9 2D E5 E5 DE E5 E5 19 20 56 BB   ..e...-...... V.
39 4B 2B BB 5A 7E 67 C0 9A 60 B5 B5 99 BB 56 44   9K+.Z~g..`....VD
71 5D 54 CB 32 9B BF CF 9D 11 4B 3D 4A FD FD B2   q]T.2.....K=J...
B2 B2 FD E5 B1 FD FD B3 B1 8B 6C DE FD E5 FD E5   ..........l.....
2D FD F9 F9 11 30 0E 28 0C 1A 21 21 21 1A 12 12   -....0.(..!!!...
07 07 07 0B 15 15 15 14 14 0B 14 09 0D 0D 0A 0A   ..............
0A 0A 03 03 0A 08 05 05 05 01 01 01 04 04 19 04   ................
06 06 06 06 06 06 06 2D 06 00 06 06 06 2D 06 06   .......-.....-..
19 06 04 04 0F 0F 01 05 05 05 08 08 08 03 05 0F   ................
19 7A 11 0A 0D 0D 09 14 14 14 15 32 14 09 0D 0D   .z.......2..
0D 0D 14 32 32 32 22 32 22 31 4B 31 21 21 46 1A   .222"2"1K1!!F.
46 3B 28 28 26 44 26 5B 5B 5B 73 46 46 73 88 53   F;((&D&[[[sFFs.S
6B 6B A9 68 A9 85 88 79 6A 69 99 52 52 52 5E 33   kk.h...yji.RRR^3
33 3C 45 45 51 41 45 41 5C 41 87 40 5C 65 87 65   3<EEQAEA\A.@\e.e
87 86 A0 A0 86 A0 7C 9B C2 BB 32 4B 4B 55 FD E1   ......|...2KKU..
7A D5 B3 CB D5 8A 82 BF 51 4E 38 4F 41 2C 84 82   z.......QN8OA,..
96 82 96 4F 4E 4E 62 4F 4F 4E 4E 4F 4F 2C 4F D8   ...ONNbOONNOO,O.
CB 5A 2C 4F 2C 4F 2C 62 62 41 2C 3A 44 96 9E 8C   .Z,O,O,bbA,:D...
76 41 7D D0 49 C1 D6 D6 D0 D6 C1 B6 DB CF CF CF   vA}.I...........
DB DB DB DB D3 A3 DC D1 A3 A3 CE DC DF 87 CC A0   ................
7C A7 B0 A8 C3 A7 A7 C3 C4 B9 8F 8F 8F 6D 7B B4   |............m{.
B4 6D BE 25 8F 25 C8 25 FE EE EA A7 B9 EA E8 CC   .m.%.%.%........
DF DF CC CC E2 B9 C8 FE EE EF EE FF FF FF C8 E7   ................
FF FF FF C8 E2 E7 29 FA FF FF FF FF FF FF EE F4   ......).........
EA CD CC CC DF CC CD D4 D4 F4 E4 D1 D4 FF FC FC   ................
C2 C2 65 86 7C A4 9D 13 E1 8B 8B DE D9 D9 94 D7   ..e.|...........
2B 56 D9 9A 21 BB 71 31 4A 7D 70 A2 A1 64 4B 72   +V..!.q1J}p..dKr
71 99 9A 32 39 72 71 E6 D9 4B 3B 6E D8 E1 E6 FD   q..29rq..K;n....
E5 B3 FD FD E5 FD B1 E5 CB 9D 93 57 E5 FD B2 FD   ...........W....
E5 B1 13 9D 28 0E 28 1A 28 1A 1A 21 21 1A 12 0B   ....(.(.(..!!...
07 07 07 12 22 15 15 09 14 14 0D 0D 0D 0D 0A 0A   ....".......
0A 03 03 0A 08 05 05 05 01 01 04 04 04 04 04 19   ................
06 19 06 2D 00 2D 00 2D 2D 2D 2D 2D 2D 06 2D 2D   ...-.-.------.--
06 06 04 04 04 01 01 01 01 05 08 08 08 03 01 19   ................



vjl


-----Original Message-----
From: larosa, vjay [mailto:larosa_vjay () emc com]
Sent: Thursday, March 06, 2003 9:19 AM
To: 'snort-users () sourceforge net'
Subject: [Snort-users] Snort pattern matching weirdness.


O.Kay, I just upgraded to Snort 1.9.1 last night. Since then I have been
getting tons
of events for a couple snort rules I wrote a while back to detect the Fun
Love virus crossing
the network. Below is an example rule I wrote which is having this problem.

alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS Fun Love
flcss.exe";
flags: A+; content: "|66 6c 63 73 73 2e 65 78 65|"; classtype:string-detect;
rev:1;)

This is the payload from one of the packets that tripped this rule. I have
been getting tons of these.
Since I upgraded. I can't for the life of me figure out how the data from
this packet tripped this rule.
Does anybody have any ideas? Is anybody else seeing rules triggered even
though packet payloads
are not correctly matched in the rule that identified them? This is not the
only rule that I have that is 
doing this either, I know of a second rule that is tripping when the data
pattern does not match.
Please help!!

AC 27 DC BB F0 DE 81 EC 4B 25 84 F3 BA 04 61 D7   .'......K%....a.
C9 7A 4E 28 38 98 F3 45 91 6B 97 B8 05 C5 75 F0   .zN(8..E.k....u.
72 B5 4D 82 F5 B4 29 B7 13 EB 4C 2E DF DC 46 F6   r.M...)...L...F.
FC 0F E2 16 85 EB E4 34 97 15 5C 4F 07 F7 C5 DE   .......4..\O....
C8 ED E5 5C 2C B1 20 97 21 2D 70 1B 24 2E 2F 70   ...\,. .!-p.$./p
1B 25 AE 2A 70 B2 DF F4 33 8A FC E6 3A 82 FD E9   .%.*p...3...:...
02 77 41 C1 CD 2B B8 4B 0A 6E 41 C1 2D 2A B8 37   .wA..+.K.nA.-*.7
15 DC 95 8E 60 BF BF C0 2D 75 04 FB C2 04 EE 9D   ....`...-u......
0E BF 2F CC A3 95 FC 0B 47 8B 85 63 CC 73 10 7B   ../.....G..c.s.{
B6 CA 3E 8A 9A DD 9B 2B F7 8D 54 2C C2 42 86 E7   ..>....+..T,.B..
92 28 FF F4 D1 8A 73 32 F1 84 E3 4E 1F B5 67 8E   .(....s2...N..g.
15 0B 39 A5 0A 9E EF A2 26 7D 71 C5 F9 D3 04 AD   ..9.....&}q.....
AA 75 3B D9 AF 8E 6F A8 9C 67 B3 DC A6 06 AB A4   .u;...o..g......
43 D6 65 C3 FF 5D D0 81 5B 12 71 58 24 FE B0 AC   C.e..]..[.qX$...
5F B0 9C 92 55 A4 91 EB 99 DF 49 DE 9E F1 B4 A2   _...U.....I.....
8C 59 4C 9E EB 9D E4 C9 2D C6 15 65 5B 8B BC 3A   .YL.....-..e[..:
E5 DD 11 83 0D 7B 96 03 2E F5 FA 7E 19 7F 2F 24   ....{.....~./$
8C F3 41 63 75 33 FF 7F AF D2 3E 67 D0 07 C4 CB   ..Acu3...>g....
F4 BB 68 B8 70 FF 7F F2 3A C1 1D DF 9F 33 74 32   ..h.p..:....3t2
90 CF B9 4E DC B1 2A 4D 42 6B CF A3 26 63 FA AD   ...N..*MBk..&c..
E7 E5 73 9B E6 0B E5 79 35 1B CF 3F 2C 2F EC 41   ..s....y5..?,/.A
2B B9 03 1A 3A DB AA D4 27 5F 02 BF 9B CF 9C 12   +...:...'_......
FE 20 70 37 75 70 AB EE ED AA B0 2A F9 F3 39 E2   . p7up.....*..9.
DD AC 83 69 3A 1D 6C 92 BF F8 2C B8 2E D8 0D B2   ...i:.l...,....
CD B4 AC E0 60 03 60 33 AE 5D C1 45 15 5C B7 82   ....`.`3.].E.\..
8B 29 B8 1E 05 97 50 70 7B 14 5C 52 C1 1D 54 70   .)....Pp{.\R..Tp
69 05 37 AE E0 26 3A EB 36 9A CC 4D 09 D7 C9 F6   i.7..&:.6..M....
B0 AD E0 AA 42 9A 32 37 DB C9 D6 84 92 89 58 43   ....B.27......XC
7E 67 3A D9 9E CD 20 EE DB 9D 6C 7F 67 10 F7 5A   ~g:... ...lg..Z
4D 97 46 EE A2 E2 BA 5F 28 AE FB 95 42 CF DF 76   M.F...._(...B..v
F2 F9 61 23 F7 67 C5 75 D7 3A F9 9C A5 91 FB 8F   ..a#.g.u.:......
E2 BA D6 68 F3 32 44 A3 EC 35 BA 20 6E 6B 94 CD   ...h.2D..5. nk..
9D 83 B8 A7 A3 98 5F AC 91 3B 20 A4 29 DB FB E3   ......_..; .)...
0A EE 8B 42 7E 32 F7 D5 28 1B CF 83 B8 73 8A 34   ...B~2..(....s.4
7F 18 C5 F9 7D 00 F7 6B C5 75 57 A2 78 2F C5 1A   ...}..k.uW.x/..
B9 6B 42 9A F2 FD 19 EE AA 97 41 E6 B6 74 61 3B   .kB.......A..ta;
C4 1A B9 6D 5D 6C 2D 02 AE 93 E7 41 03 5D 75 5D   ...m]l-....A.]u]
3A 02 56 6D 59 BB 27 7C 73 E3 30 86 37 E3 BA 05   :.VmY.'|s.0.7...
6E 9D C4 6D 6B C2 F1 0D 0F 60 63 24 E7 92 BE F5   n..mk...`c$....
8B 08 86 C3 CF 7E C9 79 FF 3C DD 10 ED 3A 69 7E   .....~.y.<...:i~
68 88 EB 3A 01 5C 54 C1 75 2B B8 98 82 EB 51 70   h..:.\T.u+....Qp
09 05 B7 87 04 CF 63 0D 5C 2B 0A 9A C7 1A F8 7B   ......c\+.....{
B5 38 8F 15 B9 34 09 7E B6 1A B8 0E D8 8C 9B 50   .8...4.~.......P
70 53 0A CE 56 70 55 05 37 AB E0 4E 2B B8 B3 0A   pS..VpU.7..N+...
EE 9C 82 9B 53 70 17 14 DC BC 82 BB A4 E0 16 48   ....Sp.........H
F0 38 66 E0 BB 09 41 63 95 81 EF 06 35 E3 AE 90   .8f...Ac....5...
E0 71 CC A8 AD 83 43 3F 4A 2C B4 49 DC 3B D8 FF   .q....C?J,.I.;..
66 29 27 F7 A3 F7 79 7B 50 AE 55 E2 96 05 2E 22   f)'...y{P.U...."
71 37 04 CE 90 FB 66 A8 CE B5 C8 7D 33 C4 CA 30   q7....f....}3..0
3B 97 5C E8 94 FB 66 13 8E A7 31 8E EB AA 44 E2   ;.\...f...1...D.
E0 DE 3D 1B 69 E4 5A E9 9F 8D 21 3E 9B 61 F6 21   ..=.i.Z...!>.a.!
BC EB BD 2E C4 9E 4C 3C 0C FA 28 0B 8B D4 C2 E0   ......L<..(.....
1D EE F5 21 A6 19 0F 83 F7 B5 59 BC 96 5A 18 BC   ...!......Y..Z..
9B DD 1E 6E B4 57 57 FE 0B 60 73 DC 7C F7 E6 BB   ...n.WW..`s.|...
FC 77 67 DF 0F 94 F5 23 6C DA E8 F7 16 5A 4C BD   .wg....#l....ZL.
2D F5 36 70 BB F3 FF B0 9E FF EB F9 BF 9E FF AF   -.6p............
F9 F9 3F 3F FF 0B FA D1 A3 6F 1C EE FF C6 BF 16   ..??.....o......
0F 9C FE E9 8F BE B6 EB E2 7F DF B8 D5 F3 BF F4   ...............
F9 3F 1A 1A 6B 0B B7 7A FE 97 81 36 00 D8 C9 1F   .?..k..z...6....
23 FA FC 2F 0D 8D B5 8C 8F EB 2A D0 D0 D0 D0 D0   #../.....*.....
D0 D0 D0 D0 D0 B8 6F B0 52 FF 5F 9F 27 6C FF 2E   ......o.R._.'l..
60 5C 57 9B 86 C6 3D 81 FF 03 40 D9 1B D5 F3 23   `\W...=...@....#
00 80 43 4B EC 9D 0F 70 94 65 7E C7 DF DD 6C 20   ..CK...p.e~...l 
39 A0 2E 16 AE C1 03 6F 83 49 0C C8 9F 05 01 03   9......o.I......
82 79 43 08 26 0A B8 01 02 C1 62 D9 85 AC 24 1A   .yC.&.....b...$.
60 09 E1 06 3A D2 6E 10 7A A1 D5 36 CC C1 14 5B   `...:.n.z..6...[
B9 6E EE A0 A2 05 DD 58 39 E1 04 6F 41 81 80 44   .n.....X9..oA..D
37 40 14 14 CE C5 81 19 EC C8 4C 98 91 0E CE 48   7@........L....H
DB EF EF 7D BE 9B DD 25 9B 64 E1 EC 4D AB FB 4E   ...}...%.d..M..N
BE FB 79 B3 FB BC CF FB FC FF F7 3E EF F3 44 FC   ..y........>..D.
90 DC 07 2C 79 24 8F 1F DE FE 5F C6 21 C3 F5 C9   ...,y$...._.!...
7D C0 92 47 F2 F8 01 EE FF 75 9A FB 7F AD CB 6A   }..G.....u....j
79 EE 3F 97 14 16 3D DF 76 6A 6A F9 D7 CF 9F 4C   y.?...=.vjj....L
EE FF 95 3C 92 C7 F7 FB E8 C3 7E 7D F8 F9 FF 22   ...<......~}..."
6E F2 3D E2 5E 4D 5B C8 F7 E3 E5 19 FF E0 FB D0   n.=.^M[.........
43 A8 D4 B4 79 5A 64 FF AF 87 79 CD 44 68 12 F4   C...yZd...y.Dh..
90 A6 D6 12 9B 02 3D 02 E5 6B 6A 0E B7 2C 56 21   ......=..kj..,V!
CB AE 14 6A 6A 2E 61 11 34 1D 7A 54 53 F3 B8 4B   ...jj.a.4.zTS..K
34 75 FF C7 35 B5 5E 96 AC 2B 34 0B 7A 42 53 73   4u..5.^..+4.zBSs
10 4A A1 D9 90 8C 47 C8 1A 65 B7 CE 2F 10 3F C8   .J....G..e../.?.
FC 02 99 67 20 F3 0B EE A2 9B 65 51 06 99 97 20   ...g .....eQ... 
EF 15 C8 BC 04 99 AF 20 73 17 E4 99 A7 CC 73 97   ....... s.....s.
79 8C B2 E4 B0 EC 6D 2E 73 17 86 68 B2 1E 9D A6   y.....m.s..h....
FD 54 53 73 DD 33 35 59 1B 45 D3 E0 75 63 FE BE   .TSs.35Y.E..uc..
AC 31 90 03 DD AF A9 F9 EE C3 A0 E1 90 6C 2D 20   .1...........l- 
EF C4 CB F2 E7 B2 05 C1 68 4D CD 19 1C 03 8D 85   ........hM......
1E 84 C6 69 6A 3E ED 84 64 92 4B 1E FF 87 0E A9   ...ij>..d.K.....
BD 4F 73 FE DF AD F5 7F D8 4C 72 FF AF E4 91 3C   .Os.....Lr....<
BE 9F 47 72 FF AF E4 91 3C 7E B8 47 78 BD AE BE   ..Gr....<~.Gx...
68 F8 FA 0F 75 AE EE A3 F7 F3 1A 7A C9 E4 6F 0C   h...u......z..o.
59 4C 8F D4 05 BA 5C 89 36 38 5E D1 3A 81 EF DC   YL....\.68^.:...
B3 C1 AB 4F                                       ...O


vjl


V.Jay LaRosa                           EMC Corporation
Information Security                  4400 Computer Dr.
(508)898-7433 office                  Westboro, MA 01580
(508)353-1348 cell                     www.emc.com
888-799-9750 pager                   larosa_vjay () emc com





-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
for complex code. Debugging C/C++ programs can leave you feeling lost and 
disoriented. TotalView can help you find your way. Available on major UNIX 
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger 
for complex code. Debugging C/C++ programs can leave you feeling lost and 
disoriented. TotalView can help you find your way. Available on major UNIX 
and Linux platforms. Try it free. www.etnus.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users