Snort mailing list archives

REMOVE

From: Daniel Holt <dholt () icsi com>
Date: Mon, 25 Sep 2017 12:41:17 +0000



Daniel Holt |Office: 410 280 3000 x108 | Fax:410-280-3001
1612 McGuckian Street | Annapolis, MD 21401
www.icsi.com | www.annapolisgeeks.com


Email support () icsi com for any technical assistance


-----Original Message-----
From: Snort-users [mailto:snort-users-bounces () lists snort org] On Behalf Of snort-users-request () lists snort org
Sent: Saturday, September 23, 2017 12:00 PM
To: snort-users () lists snort org
Subject: Snort-users Digest, Vol 4, Issue 22

Send Snort-users mailing list submissions to
        snort-users () lists snort org

To subscribe or unsubscribe via the World Wide Web, visit
        https://lists.snort.org/mailman/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
        snort-users-request () lists snort org

You can reach the person managing the list at
        snort-users-owner () lists snort org

When replying, please edit your Subject line so it is more specific than "Re: Contents of Snort-users digest..."


When responding, please don't respond with the entire Digest.  Please trim your response.


Today's Topics:

   1. Re: Misc UPNP Attak on my two network devices (a modem and a
      routeur) (wkitty42 () windstream net)
   2. Re: Question (wkitty42 () windstream net)
   3. Re: Question (Jim Campbell)
   4. Re: Question (William Pearson)


----------------------------------------------------------------------

Message: 1
Date: Fri, 22 Sep 2017 12:44:16 -0400
From: wkitty42 () windstream net
To: snort-users () lists snort org
Subject: Re: [Snort-users] Misc UPNP Attak on my two network devices
        (a modem and a routeur)
Message-ID: <7000dc65-048d-06c3-a199-84640622dfa7 () windstream net>
Content-Type: text/plain; charset=utf-8; format=flowed

On 09/21/2017 03:26 PM, Dorian ROSSE wrote:

I have a Misc UPNP Attack on my two network device a modem and a 
routeur also  how to stop this attacks from  IP : 
239.255.255.250:1900,


generally that's not an attack... that's generally the destination IP... it is a broadcast IP specifically for service 
discovery... see here for an explanation...


https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol


if you think you're part of that 2014 DDoS, you should look to your device 
manufacturers for a fix...


-- 
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list unless*
        *a signed and pre-paid contract is in effect with us.*


------------------------------

Message: 2
Date: Fri, 22 Sep 2017 12:47:53 -0400
From: wkitty42 () windstream net
To: snort-users () lists snort org
Subject: Re: [Snort-users] Question
Message-ID: <90ddfd6f-caf8-4756-f492-9f34c7f57e42 () windstream net>
Content-Type: text/plain; charset=utf-8; format=flowed

On 09/22/2017 11:46 AM, William Pearson wrote:

I'm using BASE, and the results snort is giving me is beyond vague. I presume 
this is an issue with the rules and preprocessing. I couldn't care less about 
what preprocessor is being used. I'm singularly interested in the actual rule. 
Why won't it show me the message field in the actual rules?

[snort <http://www.snort.org/search/sid/120-3>] http_inspect: NO CONTENT-LENGTH 
OR TRANSFER-ENCODING IN HTTP RESPONSE



in this example, the all CAPS /is/ the msg portion of the rule... however, 
preprocessors are slightly different in that the rules are written into the code 
of snort... kind of like the shared object rules... generally speaking, their 
msg contents cannot be changed like the text based rules that are used...


are you, perhaps, looking for the actual GID:SID of the rule? it us, that's more 
important than the msg text...


-- 
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list unless*
        *a signed and pre-paid contract is in effect with us.*


------------------------------

Message: 3
Date: Fri, 22 Sep 2017 17:25:06 -0400
From: Jim Campbell <jim () w4bqp net>
To: William Pearson <william () cnsp net>, snort-users () lists snort org
Subject: Re: [Snort-users] Question
Message-ID: <16a09599-1e18-6c3e-7ba2-ba10159477e7 () w4bqp net>
Content-Type: text/plain; charset="utf-8"; Format="flowed"

Will,

If you hover your cursor over the [snort 
<http://www.snort.org/search/sid/120-3>] at the beginning of the Alert, 
you will see the GID-SID at the bottom of the page.

Jim

On 9/22/2017 11:46 AM, William Pearson wrote:

I'm using BASE, and the results snort is giving me is beyond vague. I 
presume this is an issue with the rules and preprocessing. I couldn't 
care less about what preprocessor is being used. I'm singularly 
interested in the actual rule. Why won't it show me the message field 
in the actual rules?

[snort <http://www.snort.org/search/sid/120-3>] http_inspect: NO 
CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE


Will





_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170922/4a0da96d/attachment-0001.html>

------------------------------

Message: 4
Date: Fri, 22 Sep 2017 16:26:44 -0600
From: William Pearson <william () cnsp net>
Cc: snort-users () lists snort org
Subject: Re: [Snort-users] Question
Message-ID:
        <CAJEJux0ubtcmDVQqscsukuMgHHuGQSFhemeN+HyMtu8t+LURiQ () mail gmail com>
Content-Type: text/plain; charset="utf-8"

Jim,

Yeah, I know, but it's much easier to manage if it lists things by the msg
in the rule.

So, for example this rule,

alert tcp $HOME_NET any -> [31.214.157.227,31.41.44.130] any (msg:"ET CNC
Ransomware Tracker Reported CnC Server TCP group 86"; flags:S;
reference:url,doc.emergingthreats.net/bin/view/Main/BotCC; reference:url,$

I want it to say "ET CNC Ransomware Tracker Reported CnC Server TCP group
86" in BASE.

Will


On Fri, Sep 22, 2017 at 3:25 PM, Jim Campbell <jim () w4bqp net> wrote:

Will,

If you hover your cursor over the [snort
<http://www.snort.org/search/sid/120-3>] at the beginning of the Alert,
you will see the GID-SID at the bottom of the page.

Jim

On 9/22/2017 11:46 AM, William Pearson wrote:

I'm using BASE, and the results snort is giving me is beyond vague. I
presume this is an issue with the rules and preprocessing. I couldn't care
less about what preprocessor is being used. I'm singularly interested in
the actual rule. Why won't it show me the message field in the actual rules?

[snort <http://www.snort.org/search/sid/120-3>] http_inspect: NO
CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE


Will





_______________________________________________
Snort-users mailing listSnort-users () lists snort org
Go to this URL to change user options or unsubscribe:https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170922/fd138d55/attachment-0001.html>

------------------------------

Subject: Digest Footer

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
https://lists.snort.org/mailman/listinfo/snort-users


------------------------------

End of Snort-users Digest, Vol 4, Issue 22
******************************************
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Current thread:

REMOVE Daniel Holt (Sep 25)