UDP detection when no payload is pressent i UDP packets problem

[Lenny Hansson <security () netcowboy dk>]

Hi All
I am looking at an attack where no payload in UDP packets are present.
My SNORT installation is working on other rules and traffic types.

This attack comes from a large DDOS where the packet all look like this.
But all source IP is random and source and dest ports on UDP is random.
The only thing witch is steady is packet size.

So the idea was to look for UDP packets whit 46 Bytes and do a drop on
that and/or put in a detection filter and start dropping after receiving
500/1000 packets within 5 seconds ore so.

My starting rule was to look for UDP like the here. But here comes my
problem. I can't even get SNORT to alert on simple UDP packets like the
one attached. If I craft my own UDP packet it will alert ore if I do
testing with other UDP based attacks with content and so on.

alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"UDP no payload
attack"; priority:1; sid:880000; rev:1;)

I have attached 1 pcap with one such packet not detected with SNORT. DST
IP have been changed in the pcap file as the only thing. But the rest of
the packet is still original from the attack.

What am I missing here ? Sense I can't get SNORT to give me alerts in
logs files ore in screen ?

I am testing on SNORT version 2.9.8.2
-- 
Venlig hilsen / Best Regards
Lenny Hansson
***********************************
Web: networkforensic.dk
***********************************
E-mail: security () netcowboy dk
Key-ID: 91379877
***********************************

Attachment: No.pcap
Description:

Attachment: signature.asc
Description: OpenPGP digital signature

------------------------------------------------------------------------------
Mobile security can be enabling, not merely restricting. Employees who
bring their own devices (BYOD) to work are irked by the imposition of MDM
restrictions. Mobile Device Manager Plus allows you to control only the
apps on BYO-devices by containerizing them, leaving personal data untouched!
https://ad.doubleclick.net/ddm/clk/304595813;131938128;j

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!