Re: Same src/dst

[David Alonso De La Vega Tapage <delavegad () bancoaliado com>]

Question ..

where is the exact right place to put these rules .. ?  to mantain the 
better performace of snort ..

Thanx in advance ..

Cheers,

David Alonso

Brei, Matt wrote:

>     I have been seeing a lot of these "same SRC/DST" alerts even after adding two local rules to pass them.  I think 
> these alerts are due to the fact that there is a DNS server running on this machine and it is using itself for its name 
> resolution.
>  
>   #3-(4-1434)    
>   BAD TRAFFIC same SRC/DST    
>   2003-03-30 18:49:29    
>   10.13.110.254:1026    
>   10.13.110.254:53    
>   UDP    
>
>   #4-(4-1435)    
>   BAD TRAFFIC same SRC/DST    
>   2003-03-30 18:49:29    
>   10.13.110.254:53    
>   10.13.110.254:1026    
>   UDP    
>
> The two local rules are as follows:
>
>  pass ip 10.13.110.254 53 -> 10.13.110.254 1026 (msg:"BAD TRAFFIC same SRC/DST"; sameip; reference:cve,CVE-1999-0016; 
> reference:url,www.cert.org/advisories/CA-1997-28.html; classtype:bad-unknown; sid:527; rev:3;)
>
> pass ip 10.13.110.254 1026 -> 10.13.110.254 53 (msg:"BAD TRAFFIC same SRC/DST"; sameip; reference:cve,CVE-1999-0016; 
> reference:url,www.cert.org/advisories/CA-1997-28.html; classtype:bad-unknown; sid:527; rev:3;)
>
> These alerts are filling the database rather quickly.  Please help.  I have searched the mailing list archives as well 
> as Usenet with no helpful results.
>
> Matt
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by:
> The Definitive IT and Networking Event. Be There!
> NetWorld+Interop Las Vegas 2003 -- Register today!
> http://ads.sourceforge.net/cgi-bin/redirect.pl?keyn0001en
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=ort-users
>
>  
>
> ------------------------------------------------------------------------
>
> ****** Message from InterScan E-Mail VirusWall NT ******
>
> ** No virus found in attached file noname.htm
>
> Este correo ha sido revisado y esta libre de virus. Disclaimer
> *****************     End of message     ***************
>
>