Re: Noob question about different parts of a rule

[Matt Kettler <mkettler () evi-inc com>]

At 03:50 PM 4/28/2003 -0400, stormshadow wrote:

> I was looking at this rule trying to learn what everything in there
> means:
> alert tcp $HOME_NET 12345:12346 -> $EXTERNAL_NET any (msg:"BACKDOOR
> netbus active"; flow:from_server,established; content:"NetBus";
> reference:arachnids,401; classtype:misc-activity; sid:109; rev:4;)
>
> Can anyone explain this rule to me? I know that there are 3 modes
> right? (alert, log, and something else). What does the $HOME_NET and
> $EXTERNAL_NET mean? Why do you say "any"?
>
> Is this rule stating "alert any traffic outbound from port 12345 and
> 123456?
> Confused .
> TIA
> Storm

The first part of a snort rule is in the general format:

action protocol source_ip source_port -> destination_ip destination_port.

So the "alert tcp $HOME_NET 12345:12346 -> $EXTERNAL_NET any " part of the 
rule translates as:

Alert on packets which are TCP protocol,

coming from:
         an IP address in the range defined by HOME_NET in your snort.conf
        with a source ports between  12345 and 12346
going to
         an IP address in the range defined by EXTERNAL_NET in your snort.conf
         with any destination port

This rule also has a content specifier, so the data also needs to contain 
the text-string "NetBus" (case sensitive), and the flow modifier means it 
must be going to the client side of the TCP connection 3-way handshake.





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users