[Snort-users] pass rules for one alert
cmg at ...1935...
Tue Sep 3 16:52:01 EDT 2002
TheEagleSociety at ...2792... (Night-Stalker) writes:
> Hello John,
> the Payload, that snort logs looks like this:
> length = 131
> LIST..PASV..CDW //directory1/directory2..LIST..PASV..
> CWD //directory3/directory4..LIST..PASV..
> As I can see, it must be hourly cron-job from host1 to host2 via
> FTP. Every hour, I get 5 false positives of this alert. Only between
> these hosts. My pass-rule, I wrote below doesn't work, or it works but
> also triggers the alert-rule. As I wrote, I only want to ignore this
> false positive between these hosts and I dont't want to comment out
> the complete alert-rule to ignore all these alerts. I also don't want
> to write a pass-rule to ignore the complete FTP-Transfers between
> these hosts. Can anybody help me out?
Update to 1.9. The dsize check now returns 0 on rebuilt stream packets.
Chris Green <cmg at ...1935...>
Fame may be fleeting but obscurity is forever.
More information about the Snort-users