Snort mailing list archives
Re: RE : Help with signature - offset
From: miha rass <miha4246 () gmail com>
Date: Tue, 23 Jul 2013 10:27:28 -0400
Thanks for the input. I figured it out. I was looking to trigger off the first few bytes of the TCP payload, so by putting offset:0 it work. I am not sure why it works b/c the content data is sitting at offset:54 according to wireshark. I am guessing that content ONLY works within the TCP payload, not in the eth/ip/tcp header. Does anyone know if wireshark adds or removes any data while parsing? On Tue, Jul 23, 2013 at 1:54 AM, rmkml <rmkml () yahoo fr> wrote:
Hi Miha, Don't tested but can you try with offset:4; please ? Because here it's a payload offset. Regards @Rmkml -------- Message d'origine -------- De : miha rass <miha4246 () gmail com> Date : A : snort user list <snort-users () lists sourceforge net> Objet : [Snort-users] Help with signature - offset Hello, I am trying to id why my test snort sig wont fire from the offset. I have a generic sig that I have tested from flow, depth, content etc. It all works but the offset. I am testing the sig against some old gh0st rat traffic. below is the sig. I thought the tcp payload would start at offset 54. The content in the hex is in bold. Alert tcp any any -> any 21 (msg:"testing for gh0st"; content:"v2010"; offset:58; nocase; sid:100000939;) 0000 00 50 56 e3 19 d5 00 50 56 3c f6 41 08 00 45 00 .PV....P V<.A..E. 0010 01 31 02 74 40 00 80 06 bc ce c0 a8 6a 8d 79 3f .1.t@... ....j.y? 0020 96 0f 04 34 00 15 04 4a 7e 7d 59 4f 74 3a 50 18 ...4...J ~}YOt:P. 0030 fa f0 5d c1 00 00 76 32 30 31 30 09 01 00 00 fc ..]...*v2 010* ..... 0040 00 00 00 66 00 00 00 9c 00 00 00 05 00 00 00 01 ...f.... ........ 0050 00 00 00 28 0a 00 00 02 00 00 00 53 65 72 76 69 ...(.... ...Servi 0060 63 65 20 50 61 63 6b 20 32 00 00 3f 9b 91 7c d8 ce Pack 2..?..|. 0070 c0 97 7c eb 9a 91 7c 30 f4 40 00 90 fe ab 00 ff ..|...|0 .@...... 0080 ff 00 00 00 c0 fd 7f a8 34 24 00 ff ff ff ff 12 ........ 4$...... Thanks
------------------------------------------------------------------------------ See everything from the browser to the database with AppDynamics Get end-to-end visibility with application monitoring from AppDynamics Isolate bottlenecks and diagnose root cause in seconds. Start your free trial of AppDynamics Pro today! http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Re: RE : Help with signature - offset miha rass (Jul 23)
- Re: RE : Help with signature - offset rmkml (Jul 23)