Re: re: Pass Rule question

[Ciprian Badescu <ciprian.badescu () alcatel ro>]

Hi,


I also have the same problem:

I've done the following modifications in scan.rules:


pass tcp $EXTERNAL_NET any -> $HOME_NET 3128

alert tcp $EXTERNAL_NET any -> $HOME_NET 3128 (msg:"SCAN Squid Proxy
attempt"; flags:S,12; classtype:attempted-recon; sid:618; rev:4;)


and still got the alert in ACID (with last snort tarball from CVS).

It's normal ?
How can I use pass rules.


thanks
--
______V______   Ciprian Badescu

On Fri, 13 Jun 2003, Erek Adams wrote:

> Date: Fri, 13 Jun 2003 05:58:47 -0400 (EDT)
> From: Erek Adams <erek () snort org>
> To: lindsay.hunt () itc alstom com
> Cc: snort-users () lists sourceforge net
> Subject: Re: [Snort-users] re: Pass Rule question
>
> On Wed, 11 Jun 2003 lindsay.hunt () itc alstom com wrote:
>
> > I have a question regarding the use of pass rules. I am running snort with
> > the "-o" option and want to ignore specific snmp traffic; specifically,
> > snmp requests from a particular ip address destined for 2 separate
> > addresses.
> >
> > I created a file called pass.rules and placed it in the rules directory. It
> > has the following syntax:
> >
> >      pass udp x.x.x.x any -> udp [y.y.y.y , z.z.z.z ] 161
> >
> >
> > x.x.x.x corresponds to the source address and y and z to the destination
> > addresses.
> >
> > Is the syntax correct? The traffic that I want to ignore is still showing
> > up as alerts.  Thanks in advance for any help.
>
> It could be one of two things:
>
>       *  Make it into two different rules.  Maybe you have something
> with the IP list messed up.
>       *  Grab the nightly CVS tarball [0] and try that.  There was a
> commit made earlier this week that made some changes with the pass rules.
>
> I'm guessing it's the second one.
>
> Cheers!
>
> -----
> Erek Adams
>
>    "When things get weird, the weird turn pro."   H.S. Thompson
>
> [0]   http://www.snort.org/dl/snapshots/snort-current.tar.gz
>
>
> -------------------------------------------------------
> This SF.NET email is sponsored by: eBay
> Great deals on office technology -- on eBay now! Click here:
> http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users