[Snort-sigs] First attempt at writing a sig

Alex Kirk alex.kirk at ...435...
Mon Dec 20 06:27:00 EST 2004


Lance,

As has been said by all the Bleeding folks, not bad for a first rule. 
I've got one more thing you'll want to contemplate, though (and would 
have added it earlier in the discussion, but this whole exchange took 
place *after* I'd left for the airport on Friday afternoon). Does Netop 
use TCP, and thus establish a connection (Syn, Syn/Ack, Ack) before 
sending this data? If so, you'll want to add the flow keyword to our 
rule, either as flow:established or flow:(to|from)_server,established 
(depending there on which direction the packets would be headed). The 
concept here is simple: by adding the flow keyword, you can let Snort 
only pay attention to the subset of packets that have met the required 
TCP connection criteria, dramatically speeding performance in the 
process. Honestly, it's such a key part of good rule-writing to consider 
flow that it's become automatic for me to type flow: after my rule's msg 
-- on the rare occasion it's not relevant, I just laugh at myself and 
delete it before continuing.

Also, you may want to consider not using any any -> any any, but instead 
$HOME_NET any -> any any, for much the same reason you'd want to add 
flow. After all, if you know that all of the traffic you care about will 
be originating on your $HOME_NET, why bog Snort down by looking at all 
the gunk coming in from the Internet at large? Alternately, if you know 
that everything will start from $HOME_NET + your "remote subnets", you 
might consider creating a variable which encompasses all of those IPs 
(which is probably a good variable to have anyway) and using it instead 
of $HOME_NET here.

I hope that's helpful information...and feel free to ask if I've 
confused you or you need clarification. :-)

Alex Kirk
Research Analyst
Sourcefire, Inc.

>Thanks for pointing that out here's the updated rule
>
>alert udp any any -> any any (msg:"Netop Remote Control Usage";
>content:"|554b30303736305337473130|"; reference:url,www.netop.com;
>classtype:policy-violation; sid:2000000; rev:2;)
>
>This caught my traffic going to my remote subnets. I tried increasing
>the revision # as well but to no avail so I changed the sid to 2000001
>
>
>alert udp any any -> any any (msg:"Netop Remote Control Usage";
>content:"|554b30303736305337473130|"; reference:url,www.netop.com;
>classtype:policy-violation; sid:2000001; rev:1;)
>
>Now it's showing up in Acid correctly
>
>-----Original Message-----
>From: Matt Jonkman [mailto:matt at ...2436...] 
>Sent: Friday, December 17, 2004 2:10 PM
>To: Lance Boon
>Cc: snort-sigs at lists.sourceforge.net
>Subject: Re: [Snort-sigs] First attempt at writing a sig
>
>Not a bad run for a first sig. Thanks for posting it.
>
>Why did you go home-home net? Why not home-any? Or even any-any? I'm not
>
>that familiar with the tool, but I'd think the most interesting traffic 
>would be someone from the outside connecting to a local box.
>
>As far as why it doesn't show right in acid, not sure. It is crafted 
>correctly. Try increasing the rev number and hitting it again. I wonder 
>if maybe the first time you had a hit the msg was empty, in which case 
>it won't take the new msg until the rev # increases.
>
>I'll put this up on bleeding snort for more testing after we sort out 
>the reasons for the home-home.
>
>Matt
>
>Lance Boon wrote:
>
>  
>
>>This is my first attempt at writing a sig and wondered if anybody had
>>any pointers. I got a pcap of a netop session to 2 different systems,
>>ran it through snort and noticed that the content was the same on in
>>    
>>
>one
>  
>
>>particular packet. So I wrote a rule for it, I have this working on my
>>network right now and haven't had any false positives yet. The only
>>thing that is bugging me and I'm sure that it's something that I'm
>>missing is that when an alert hits it doesn't read "Netop Remote
>>    
>>
>Control
>  
>
>>Usage" on the acid page it just says [snort] Snort Alert [1:2000000:0] 
>>
>>alert udp $HOME_NET any -> $HOME_NET any (msg:"Netop Remote Control
>>Usage"; content:"|554b30303736305337473130|";
>>reference:url,www.netop.com; classtype:policy-violation; sid:2000000;
>>rev:1)
>> 
>>
>>    
>>
>
>  
>





More information about the Snort-sigs mailing list