[Snort-users] pass rules for one alert

Chris Green cmg at ...1935...
Tue Sep 3 16:52:01 EDT 2002


TheEagleSociety at ...2792... (Night-Stalker) writes:

> Hello John,
>
> the Payload, that snort logs looks like this:
>
>   length = 131
>   LIST..PASV..CDW //directory1/directory2..LIST..PASV..
>   CWD //directory3/directory4..LIST..PASV..
>
> As I can see, it must be hourly cron-job from host1 to host2 via
> FTP. Every hour, I get 5 false positives of this alert. Only between
> these hosts. My pass-rule, I wrote below doesn't work, or it works but
> also triggers the alert-rule. As I wrote, I only want to ignore this
> false positive between these hosts and I dont't want to comment out
> the complete alert-rule to ignore all these alerts. I also don't want
> to write a pass-rule to ignore the complete FTP-Transfers between
> these hosts.  Can anybody help me out?

Update to 1.9. The dsize check now returns 0 on rebuilt stream packets.
-- 
Chris Green <cmg at ...1935...>
Fame may be fleeting but obscurity is forever.




More information about the Snort-users mailing list