[Snort-sigs] Rule 2101 FP's...

Nigel Houghton nigel at ...435...
Wed Jul 14 13:42:10 EDT 2004


Make sure your $HOME_NET and $EXTERNAL_NET variables are set correctly.

On  0, Tobias Rice <rice at ...2618...> allegedly wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Greetings,
> I'm not sure if this is the correct method for sending a FP, so please
> let me know if there are better ways to do this.
> 
> Rule 2101 gives false positives when our windows clients send print jobs
> to our windows print servers. I'm not sure what can be done considering
> the content [0] but it is included for your review.
> Thanks for your time.
> Tobias Rice
> 
> [0]
> length = 100
> 
> 000 : 00 00 00 60 FF 53 4D 42 25 00 00 00 00 18 07 C8   ...`.SMB%.......
> 010 : 00 00 00 00 00 00 00 00 00 00 00 00 00 08 9C 04   ................
> 020 : 00 08 45 20 10 00 00 00 00 00 00 00 00 00 00 00   ..E ............
> 030 : 00 E8 03 00 00 00 00 00 00 60 00 00 00 00 00 02   .........`......
> 040 : 00 53 00 00 00 1D 00 00 5C 00 50 00 49 00 50 00   .S......\.P.I.P.
> 050 : 45 00 5C 00 73 00 70 00 6F 00 6F 00 6C 00 73 00   E.\.s.p.o.o.l.s.
> 060 : 73 00 00 00                                       s...
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (MingW32)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
> 
> iD8DBQFA4EX1RJX8S0T0CkURAkTMAKDDd/Lvvps4D2stcV7d8Uim8otIggCePDbg
> Yt1ob2Vy17G2sFnkc1Fyz3M=
> =59mU
> -----END PGP SIGNATURE-----
> 
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by BEA Weblogic Workshop
> FREE Java Enterprise J2EE developer tools!
> Get your free copy of BEA WebLogic Workshop 8.1 today.
> http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> 
-------------------------------------------------------------
Nigel Houghton       Research Engineer        Sourcefire Inc.
                 Vulnerability Research Team

"Dude, dolphins are intelligent and friendly!" -- Wendy
"Intelligent and friendly on rye bread, with some mayonaise." -- Cartman




More information about the Snort-sigs mailing list