Snort mailing list archives
RE: Help, tons of false positive ASN1 overflow attempts.
From: "M Shirk" <shirkdog_linux () hotmail com>
Date: Tue, 24 Aug 2004 07:38:26 -0400
I know there are several things.1. You can just turn off the rule. If you know its a false positive and does not affect your environment.
2. You can make a separate rule to pass on the source and destination of this particular rule.
3. *My Fav* make a ruletype to log it as false positives. (I think there are other ways :-) However, I just saw this last night in Snort 2.2. It is the threshold.conf fileIt appears that you can filter out rules by sid or other information. Check your source code for this file and read it. Most of the information I can not remember is in the file.
Shirkdog
From: aharon () tamparacing com To: snort-users () lists sourceforge netSubject: [Snort-users] Help, tons of false positive ASN1 overflow attempts.Date: Thu, 19 Aug 2004 14:19:49 -0400 (EDT) Pardon my vague message here. I am a snort newbie! I just installed Snort v2.2.0 and the latest signatures inside our network here at work. Anyway, everything seems to work great, except for a vast amount of false positive ASN1 warnings. I do not want to disable these ASN1 signatures becuase they would be very usefull in finding virus infected PC's throughout our network. Most ASN1 errors seem to be communications between XP clients and windows 2000 and 2003 servers. For example: 0.01 1 172.16.221.166 10.33.1.108 NETBIOS SMB DCERPC NTLMSSP asn1 overflow attempt {tcp} .166 is a clean virus free XP client, and .108 is a Windows 2003 server. I am getting literally hundreds of these a second. How can I help in figuring out what this issue is? I can provide any info you need, just tell me what you need me to do. Aharon ------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
_________________________________________________________________FREE pop-up blocking with the new MSN Toolbar get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/
------------------------------------------------------- SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift. http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: Help, tons of false positive ASN1 overflow attempts. M Shirk (Aug 24)