[Snort-sigs] Reducing FPs by linking attacks to service versions

Matt Jonkman matt at ...2436...
Sat Dec 4 07:02:01 EST 2004

root wrote:

>I have just been playing with flowbits, and am wondering if there would be adverse effects to linking rules to specific service version where applicable.
I think that's a great idea. The snag may be making sure your research 
is good on some of the sigs, and being certain that it affects only a 
certain version.

A potential problem would be any versions of servers that the version 
string has been altered, as many people do with apache servers, etc. 
This would have to be an optional modification. Probably not something 
we could put in the mail sets of rules. At Bleeding snort I generally 
prefer to have the default set of rules work for as many situations as 
possible and local changes can be made to further customize.

I think it'd be worth it to have a secoind set of rules that are 
modified in this way, so that if you knew you hadn't altered the version 
string on any of your servers then you could run those rules.

I am curious about the performance impacts. Can any of the snort folks 
comment on whether this would cause a significant load increase?

Very good idea.


>Simple example 
> alert tcp $HTTP_SERVERS $HTTP_PORTS -> any any \
> (msg:"IS IIS4"; sid:2000000; \
> rev:0; classtype:not-suspicious; \
> content: "Server\: Microsoft-IIS\/4.0"; \
> flowbits: set,isiis4; \
> flowbits: noalert;)
> (msg:"New IIS4 fpcount attempt"; \
> sid:2000002; rev:0; classtype:web-application-attack; \
> flow:to_server,established; \ 
> uricontent:"/fpcount.exe"; \
> content:"Digits="; nocase; reference:bugtraq,2252; reference:cve,1999-1376; \
> flowbits: isset,isiis4;)
>How much of a resource hit would there be on a system to track connections in this way?

More information about the Snort-sigs mailing list