[Snort-users] pass rules for one alert

Matt Kettler mkettler at ...4108...
Mon Sep 2 11:11:35 EDT 2002


That pass rule (if run with snort -o) will cause all ftp command channel 
data that is in a single packet >100 bytes to be completely ignored.

My suggestion is just disable the rule that's causing your false alarm 
problem by commenting it out with a #.

At 07:39 AM 9/2/2002 -0400, Night-Stalker wrote:
>Hello everybody,
>
>I have a simple question:
>I want to ignore exactly one rule, that triggers false positives from one 
>host to another. To do so, I wrote an pass-rule like that:
>
>pass tcp <source-ip> any -> <dest-ip> 21 (msg:"FTP command overflow 
>attempt"; flags:A+; dsize:>100; reference:bugtraq,4638; 
>classtype:protocol-command-decode; sid:1748; rev:3;)
>
>I don't want to ignore all FTP-Data between these hosts, only the FTP-Data 
>that triggers this alert (thats means the pass-rule:
>pass tcp <source-ip> any -> <dest-ip> 21
>isn't precise enough. And ignores all FTP-Data.)
>
>Is it possible to ignore exactly the FTP-Data between these Hosts, that 
>triggers that alert. I want the other FTP-Data between these Hosts being 
>scanned for other FTP-Exploits except the "FTP command overflow attempt".
>
>System: Debian 3.0 x86, snort 1.8.7, ACID, MySQL
>Snort-Options: snort -c /my/way/to/snort.conf -d -D -e -g snortgroup -i 
>eth0 -o -u snortuser
>Interface: eth0, no IP-Address
>
>
>Thanks
>
>Addy
>
>__________________________________________________________________
>The NEW Netscape 7.0 browser is now available. Upgrade now! 
>http://channels.netscape.com/ns/browsers/download.jsp
>
>Get your own FREE, personal Netscape Mail account today at 
>http://webmail.netscape.com/
>
>
>-------------------------------------------------------
>This sf.net email is sponsored by: OSDN - Tired of that same old
>cell phone?  Get a new here for FREE!
>https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list