[Snort-users] Question on port lists and negation

Jason security at ...5028...
Mon Oct 8 20:55:38 EDT 2007



Richard Bejtlich wrote:
> On 10/8/07, Matthew Watchinski <mwatchinski at ...1935...> wrote:
>> Richard Bejtlich wrote:
>>> Say I create this snort.conf:
>>>
>>> portvar MY_HTTP_PORTS [80,81,82,83,88,8000,8008,8080]
>>> alert tcp any any -> any !$MY_HTTP_PORTS (msg:"Example Not"; sid:4;)
>>>
>> It alerts because
>>
>> 192.168.2.105:50970 -> 192.168.2.103:8000
>> is no different than
>> 192.168.2.103:8000 -> 192.168.2.105:50970
>>
>> cause you are running with any any -> any !PORTS
>>
>> any any matches both 192.168.2.105:50970 -> 192.168.2.103:8000
>> and 192.168.2.103:8000 -> 192.168.2.105:50970
>>
> 
> Hi Matt,
> 
> Thanks for your comments.  I don't understand why these packets are
> "no different".  The MY_HTTP_PORTS variable includes 8000.  If I
> negate MY_HTTP_PORTS in my rule, why do I get an alert on
> 192.168.2.105:50970 -> 192.168.2.103:8000?  Is it because port 8000 in
> the packet is not other ports in the variable, like 80, 81, etc.?

NOTE: I've not had a chance to look at the code, I could be wrong,
please verify.

I think there may two issues working together.

1) not(80 and 81 and 82...) is different than (not 81 and not 81...)
2) not(80 and 81 and 82...) will always be true

I would expect the same behavior if you ran

$ nc -v 192.168.2.103 8001

as the command you are testing

$ nc -v 192.168.2.103 8000

because

not (80 and 81 and 82 and 83 and 88 and 8000 and 8008 and 8080) is
always true, it is not possible for a single port to be both 81 and 82
and thus when you negate the negative you get a positive.

Same rules apply when dealing with ip addresses IIRC.




More information about the Snort-users mailing list