Snort mailing list archives
flowbits: file.dcr
From: waldo kitty <wkitty42 () windstream net>
Date: Wed, 29 May 2013 10:58:04 -0400
there is no check rule in the *.rules files for flowbits: file.dcr... additionally, both existing rules' MSG are identical... one should speak of "to client" and the other "to SMTP server" in the MSG for clarity?? registered subscriber using latest rules pulled 26 May 2013 for ,,_ -*> Snort! <*- o" )~ Version 2.9.4.1 GRE (Build 69) '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using libpcap version 1.1.1 Using PCRE version: 7.8 2008-09-05 Using ZLIB version: 1.2.6 May 26 04:25:44 frodo snort[22314]: WARNING: flowbits key 'file.dcr' is set but not ever checked. $ grep -E "file.dcr" /path/to/snort/*rules*/*.rules /path/to/snort/rules/file-identify.rules:alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-IDENTIFY Adobe Director Movie file magic detected"; flow:to_client,established; file_data; content:"Shockwave 3D"; fast_pattern:only; content:"XFIR"; depth:4; flowbits:set,file.dir; flowbits:set,file.dcr; flowbits:noalert; metadata:service http, service imap, service pop3; reference:url,www.fileinfo.com/extension/dir; classtype:misc-activity; sid:17801; rev:13;) /path/to/snort/rules/file-identify.rules:alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-IDENTIFY Adobe Director Movie file magic detected"; flow:to_server,established; file_data; content:"Shockwave 3D"; fast_pattern:only; content:"XFIR"; depth:4; flowbits:set,file.dir; flowbits:set,file.dcr; flowbits:noalert; metadata:service smtp; reference:url,www.fileinfo.com/extension/dir; classtype:misc-activity; sid:23724; rev:4;) -- NOTE: No off-list assistance is given without prior approval. Please keep mailing list traffic on the list unless private contact is specifically requested and granted. ------------------------------------------------------------------------------ Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET Get 100% visibility into your production application - at no cost. Code-level diagnostics for performance bottlenecks with <2% overhead Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap1 _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- flowbits: file.dcr waldo kitty (May 29)