Re: snort_inline (content/replace) won't let me prove it's cool :(

["John Smith" <genericjohnsmith () gmail com>]

oops I don't think I replied to list. Below is my reply

On 4/24/06, Will Metcalf <william.metcalf () gmail com> wrote:
> Your content match has to be be exactly the same length as the data
> that you are replacing  it with

that's not really the issue...I can live with that constraint. Normal
windows/linux/mac pings have standard padding, so we're just want to
replace anything that's NOT the normal ping packet content "|08 09 0a
0b 0c...|" (on linux). This will be fixed length, but the problem is
that the content:! doesn't seem to match a packet where this data is
changed to a message (you can check this on your systems by trying a
content:! rules and instead of using the expected 08 09 0a... with ff
ff ff with the offset into the packet which corresponds to the exact
location where the 08 09 0a etc starts and ends(sorry I don't have the
numbers on that right now) and seeing that it won't overwrite the
packet.)

(ADDED)
Another way to think of the logic I'm expecting from snort is this: If
I have a packet and it's content is "foo" then if I ask for
snort_inline to match !"bar" shouldn't that match "foo"?
(ADDED)

, oh how very uncool of us not wanting
> to break TCP/IP and everything ;-)

oh yeah, not that you mention it, "you've changed man...you used to be cool" :P

> Regards,
>
> Will
>
> On 4/24/06, John Smith <genericjohnsmith () gmail com> wrote:
> > OK, here's the situation. I'm doing a demo about setting up
> > snort_inline but I wanted a spicy example of the rewrite rule to show
> > that snort_inline can get rid of TRIVIAL covert channels (It obviously
> > can't handle real ones, but that's fine). So if you look at your
> > standard ping packet from windows or linux it has the same pattern in
> > the payload after the time stamps. For linux it is like hex 08 09 0a
> > 0b etc to 35 I think. So what I want to do is say that (assuming
> > linux) any ICMP packet which doesn't have have that specific "known
> > good" pattern should instead be replaced. (Obviously I'm forming the
> > solution in this way because snort inline won't let me use regexes).
> > So what I *think* I should be doing is
> > content:!"|08 09 0a....35"; replace:"0000...0";
> > to just overwrite everything with hex 30 (ascii zero).
> >
> > But it isn't replacing on a ping which has data inside it. If I don't
> > use the ! it replaces for a regular ping packet. I tried testing the
> > content:! rule by doing something like
> > content:!"|ff|"; replace:"0";
> > but that doesn't work either, so what is the content:! rule really
> > doing/matching?
> >
> > Thanks!
> >
> > John
> >
> >
> > -------------------------------------------------------
> > Using Tomcat but need to do more? Need to support web services, security?
> > Get stuff done quickly with pre-integrated technology to make your job easier
> > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> > http://sel.as-us.falkag.net/sel?cmdlnk&kid0709&bid&3057&dat1642
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?listsnort-users


-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users