Snort mailing list archives
Re: Question regarding a rule
From: Y M <snort () outlook com>
Date: Tue, 24 Jun 2014 20:25:07 +0000
I'm confused as to why there are so many alerts.
These could be false positives. Have you made any major changes to your snort.conf file? Date: Tue, 24 Jun 2014 19:00:24 +0100 From: chas5873 () gmail com To: jlay () slave-tothe-box net CC: snort-sigs () lists sourceforge net Subject: Re: [Snort-sigs] Question regarding a rule Cheers for both of your replies. I tried adding the to_server bit funnily enough just before you wrote that email, still no luck unfortunately. I've tried adding the detection filter on as well, still no luck with that either! The alerts are still piling through a few minutes after, over the period of about three seconds. As well as the time delay, I'm confused as to why there are so many alerts. Apologies, didn't mean to email you back directly James. Cheers On Tue, Jun 24, 2014 at 6:39 PM, James Lay <jlay () slave-tothe-box net> wrote: On 2014-06-24 11:26, Y M wrote:
Ok, GUI is out of the way.
I am just guessing here, but since there is no flow direction in the
rule; only "established" without a flow direction (to_server,
from_client, etc...) Snort will alert after it flushes the tcp
sessions, I am almost sure that I read this somewhere. If you use,
for
example, to_server, Snort would alert as soon as the content matches
and knows that it was you (the client) who established/initiated the
connection (through stream5) and alert based on that. However, I
stand
corrected on all of the above.
If you add the flow direction to your rule, does that change the
alerting behavior?
-------------------------
Date: Tue, 24 Jun 2014 18:09:05 +0100
Subject: Re: [Snort-sigs] Question regarding a rule
From: chas5873 () gmail com
To: snort () outlook com
CC: snort-sigs () lists sourceforge net
Cheers for the reply mate.
I'm not using a GUI, just running it in through a terminal. It's the
only rule which it's happening with so far, confusing me to say the
least!
On Tue, Jun 24, 2014 at 6:06 PM, Y M <snort () outlook com [8]> wrote:
Are you using a GUI or just running in console mode to view the
alerts? "Usually", in a GUI scenario, alerts are cached and
depending in refresh rates the alerts will show up. Does this happen
only for this rule or others as well?
-------------------------
Date: Tue, 24 Jun 2014 17:17:09 +0100
From: chas5873 () gmail com [1]
To: snort-sigs () lists sourceforge net [2]
Subject: [Snort-sigs] Question regarding a rule
Hi guys,
I'm having a bit of trouble with a rule that I'm playing around with
to detect torrent usage.
alert tcp any any -> any any (msg: "P2P torrent metafile download";
content:"|38 64 61|"; flow:established; classtype:policy-violation;
sid:1000001; rev:1;)
After examining the hex dumps from multiple torrents, I noticed that
they all begin with 38 64 61, so that's where I managed to get that
content from.
When I run Snort and download the torrent though, it doesn't alert
me straight away, however gives me about 20 alerts about 3 - 4
minutes later.
Does anyone have any idea what could be causing this?
Cheers,
Charlie
Also try detection_filtering your sid for testing: alert tcp any any -> any any (msg:"P2P torrent metafile download"; content:"|38 64 61|"; flow:established; classtype:policy-violation; detection_filter: track by_dst, count 1, seconds 60; sid:1000001; rev:1;) I've seen cases where if too many alerts fire on the same content they won't all show up at the same time. James ------------------------------------------------------------------------------ Open source business process management suite built on Java and Eclipse Turn processes into business applications with Bonita BPM Community Edition Quickly connect people, data, and systems into organized workflows Winner of BOSSIE, CODIE, OW2 and Gartner awards http://p.sf.net/sfu/Bonitasoft _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort! ------------------------------------------------------------------------------ Open source business process management suite built on Java and Eclipse Turn processes into business applications with Bonita BPM Community Edition Quickly connect people, data, and systems into organized workflows Winner of BOSSIE, CODIE, OW2 and Gartner awards http://p.sf.net/sfu/Bonitasoft _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
------------------------------------------------------------------------------ Open source business process management suite built on Java and Eclipse Turn processes into business applications with Bonita BPM Community Edition Quickly connect people, data, and systems into organized workflows Winner of BOSSIE, CODIE, OW2 and Gartner awards http://p.sf.net/sfu/Bonitasoft
_______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Question regarding a rule Charlie Egan (Jun 24)
- Re: Question regarding a rule Y M (Jun 24)
- Re: Question regarding a rule Charlie Egan (Jun 24)
- Re: Question regarding a rule Y M (Jun 24)
- Re: Question regarding a rule James Lay (Jun 24)
- Re: Question regarding a rule Charlie Egan (Jun 24)
- Re: Question regarding a rule James Lay (Jun 24)
- Re: Question regarding a rule Charlie Egan (Jun 24)
- Re: Question regarding a rule James Lay (Jun 24)
- Re: Question regarding a rule Charlie Egan (Jun 24)
- Re: Question regarding a rule Charlie Egan (Jun 24)
- Re: Question regarding a rule Y M (Jun 24)
- Re: Question regarding a rule Y M (Jun 24)
- Re: Question regarding a rule Charlie Egan (Jun 24)
- Re: Question regarding a rule rmkml (Jun 24)
- Re: Question regarding a rule Charlie Egan (Jun 24)
- Re: Question regarding a rule James Lay (Jun 25)
- Re: Question regarding a rule Charlie Egan (Jun 25)
- Re: Question regarding a rule James Lay (Jun 25)
- Re: Question regarding a rule Charlie Egan (Jun 25)
- Message not available
- Re: Question regarding a rule Charlie Egan (Jun 26)
- Re: Question regarding a rule James Lay (Jun 26)
- Re: Question regarding a rule Charlie Egan (Jun 26)