[Snort-users] pass rules for one alert
mkettler at ...4108...
Mon Sep 2 11:11:35 EDT 2002
That pass rule (if run with snort -o) will cause all ftp command channel
data that is in a single packet >100 bytes to be completely ignored.
My suggestion is just disable the rule that's causing your false alarm
problem by commenting it out with a #.
At 07:39 AM 9/2/2002 -0400, Night-Stalker wrote:
>I have a simple question:
>I want to ignore exactly one rule, that triggers false positives from one
>host to another. To do so, I wrote an pass-rule like that:
>pass tcp <source-ip> any -> <dest-ip> 21 (msg:"FTP command overflow
>attempt"; flags:A+; dsize:>100; reference:bugtraq,4638;
>classtype:protocol-command-decode; sid:1748; rev:3;)
>I don't want to ignore all FTP-Data between these hosts, only the FTP-Data
>that triggers this alert (thats means the pass-rule:
>pass tcp <source-ip> any -> <dest-ip> 21
>isn't precise enough. And ignores all FTP-Data.)
>Is it possible to ignore exactly the FTP-Data between these Hosts, that
>triggers that alert. I want the other FTP-Data between these Hosts being
>scanned for other FTP-Exploits except the "FTP command overflow attempt".
>System: Debian 3.0 x86, snort 1.8.7, ACID, MySQL
>Snort-Options: snort -c /my/way/to/snort.conf -d -D -e -g snortgroup -i
>eth0 -o -u snortuser
>Interface: eth0, no IP-Address
>The NEW Netscape 7.0 browser is now available. Upgrade now!
>Get your own FREE, personal Netscape Mail account today at
>This sf.net email is sponsored by: OSDN - Tired of that same old
>cell phone? Get a new here for FREE!
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:
More information about the Snort-users