Re: snort 2.3.3 --enable-flexresp

[Matt Kettler <mkettler () evi-inc com>]

hans wrote:

> hi all 
>
> i tried the experimental feature '--enable-flexresp' for 
> compiling snort 2.3.3 on solaris 9 ( both sparc and intel plattform ) 
>
> the first tests did run well, the following rule did 
> disconnect an incomming connection immediate:
>
> alert tcp any any <> $HOME_NET 25 (msg:"HELLOon25"; resp:rst_all; )
>
> the next step was to modify this rule sligthly. the disconnect should 
> only appear, if the word "hello" was seen, with this rule: 
>
> alert tcp any any <> $HOME_NET 25 (msg:"HELLOon25"; content:"hello"; resp:rst_all; )
>
> i telnet to port 25, key in "hello"  ( knowing it's not a smtp-dialog  ) 
> and nothing happens. i get a logentry, so the rule is involved 
> if the word "hello" is seen, but no disconnect. 
>  

When you use a telnet client to generate test traffic, the telnet client
will generally send one TCP segment per character because the telnet
client explicitly disables the nagle algorithm.

Since you are typing it out by hand, the string is actually sent so slow
that the mailserver has a chance to acknowledge every individual character.

Snort's stream re-assembly flushes whenever an ACK packet from the
server comes by.

Thus, each individual character was probably run through the rules
engine separately, instead of as a single string "HELLO"

Try using something like netcat instead of telnet, which more
realistically simulates network traffic.




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users