[Snort-users] Trouble with pass rule
neil at ...1633...
Tue Apr 29 08:18:06 EDT 2003
Carl <lists at ...9056...> wrote below, asking:
[ Why does my pass rule not work. ]
The way you have your variables set the alert rule picks up traffic
from any port, anywhere, to any port on your home net. The source
address of the alert is 10.27.13.211, which matches "anywhere," and
the target address is 10.27.255.255, which matches "10.27.0.0/16".
Your pass rule affects traffic moving between 10.47.0.0./16 and your
home net -- note the second octet is "47", not "27" ( typo?). That's
why the pass rule isn't doing what you want.
I hope this helps.
Neil Dickey, Ph.D.
Northern Illinois University
>I am getting a bunch of false positives on CID 1322:
>alert ip $EXTERNAL_NET any -> $HOME_NET any ( sid: 1322; rev: 4; msg: "BAD
TRAFFIC bad frag bits"; fragbits: MD; classtype: misc-activity;)
[ ... ]
>The variable settings:
>var HOME_NET [192.168.0.0/24,10.27.0.0/16]
>var EXTERNAL_NET any
>Example alert (from /var/log/snort/alert):
>[**] [1:1322:4] BAD TRAFFIC bad frag bits [**]
>[Classification: Misc activity] [Priority: 3]
>04/28-17:50:18.327281 10.27.13.211 -> 10.27.255.255
>UDP TTL:64 TOS:0x0 ID:30423 IpLen:20 DgmLen:1500 DF MF
>Frag Offset: 0x0172 Frag Size: 0x0014
>I added the following pass rule, and set snort to run with the -o flag:
>var EPP_CHATTERS 10.47.0.0/16
>pass ip $EPP_CHATTERS any -> $HOME_NET any ( sid: 1000001; rev: 7; fragbits:
>But I still get the alerts. The traffic is a local application protocol that
uses large UDP datagrams
>that get fragmented into 1500-bytes IP packets (plus one for the leftover). All
but the final
>leftover have the DF and MF flags set, as shown in the alert. The final has DF
only, and isn't
>I also removed CID 521 (MISC Large UDP Packet) which this was triggering as
>As you can see (rev: 7), I tried a few things, like making it UDP vs. IP,
adding the UDP
>ip_proto: 17, stuff like that.
>Any ideas? I can send more traces if that helps. Although some of the packets
>sensitive data, I can try to black it out.
>This sf.net email is sponsored by:ThinkGeek
>Welcome to geek heaven.
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:
More information about the Snort-users