Possibly a bug in 2.6.1.x (CVS) with flowbits?

[Jason Haar <Jason.Haar () trimble co nz>]

(FYI I'm currently running CVS release due to stream4 bug in 2.6.1.1)

The following rule triggered on one of our snort boxes today:

"BACKDOOR superspy 2.0 beta runtime detection - file management"

They are configured to log via syslog and via mysql (not barnyard). The
problem is that the syslog alert came through - but the mysql one didn't.

This is certainly not expected. By the time I got around to noticing it
(40 min later), there were several other unrelated IDS events picked up
both by syslog and mysql. i.e. it seems to be something specific to that
(type of) rule that caused the mysql log entry to not happen. I have
mysql logging turned on and there was no sign of a mysql error, so I'm
guessing it's not mysql losing it (also, snort normally generates a
syslog record when it sees SQL backend problems - and there's no
evidence of that either).

Anyway, that rule is actually two. There's a
"flowbits:set,superSpy_20_Beta_FileMgt; flowbits:noalert" rule followed
by the actual alert rule "flowbits:isset,superSpy_20_Beta_FileMgt".

I am wondering if snort is mistakenly reading the "noalert" statement in
the first rule as still being valid for the 2nd rule...? Bit of a push -
but that's the only obvious thing I can notice...

-- 
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users