[Snort-users] Help with pass rule

Harper, Patrick patrick.harper at ...11593...
Wed Sep 1 11:45:00 EDT 2004


You have to restart with a -o 




 
-----Original Message-----
From: Carlton L. Whitmore [mailto:cwhitmore at ...12125...] 
Sent: Wednesday, September 01, 2004 10:48 AM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Help with pass rule

Joel was nice enough to help me with this rule, but it doesn't seem to
be blocking the notifications. I put it in the local.rules file and made
sure that rule is active in the snort.conf file. I also restarted the
snort service. What else do I need to do?

( I'm trying to block these false notifications that are originating
from the server 160.214.186.9 to any client )

 

 

 

(here is the notification)

 

 

EVENT LOG

Application

EVENT TYPE

Information

SOURCE

snort

EVENT ID

1

COMPUTERNAME  

PE1300

TIME

9/1/2004 11:42:02 AM

MESSAGE

[1:2404:5] NETBIOS SMB-DS Session Setup AndX request unicode username
overflow attempt [Classification: Attempted Administrator Privilege
Gain] [Priority: 1]: {TCP} 160.214.186.9:2636 -> 160.214.186.45:445 

 

 

(here is the rule Joel provided)

pass tcp 160.214.186.9 any -> $HOME_NET 137:445 (msg:"netbios pass

servertoclient";)

 





Disclaimer:
This electronic message, including any attachments, is confidential and intended solely for use of the intended recipient(s). This message may contain information that is privileged or otherwise protected from disclosure by applicable law. Any unauthorized disclosure, dissemination, use or reproduction is strictly prohibited. If you have received this message in error, please delete it and notify the sender immediately. 







More information about the Snort-users mailing list