[Snort-users] Pulledpork doesn't disable some rules

Y M snort at ...15979...
Mon Apr 14 09:28:38 EDT 2014




> Ok, I have applied the following solution posted in
> https://code.google.com/p/pulledpork/issues/detail?id=82, using
> modifysid option without luck.
 
This depends on how you are modifying  the rule in the modifysid.conf file, and if there are other rules that check if this particular flowbit is set. For example: Rule A --> sets --> flowbit 1Rule B --> checks (isset/isnotset) --> flowbit 1 In this case, if you disable Rule A, PulledPork will re-enable it since another rule (Rule B) is checking the same flowbit (flowbit 1). The order in which PulledPork will process the rules (modifysid.conf first) is already committed to PulledPork v0.7. Which means that if modify (pcre or so as documented) your rule in the modifysid.conf file by removing the flowbits setting, it will be processed first, hence, the dependency should be removed already before moving along.
YM 
> Date: Mon, 14 Apr 2014 09:29:42 +0000
> From: carlopmart at ...11827...
> To: snort-users at lists.sourceforge.net; pulledpork-users at ...14071...
> Subject: Re: [Snort-users] Pulledpork doesn't disable some rules
> 
> On Mon, Apr 14, 2014 at 7:32 AM, C. L. Martinez <carlopmart at ...11827...> wrote:
> > On Mon, Apr 14, 2014 at 6:22 AM, Y M <snort at ...15979...> wrote:
> >> This is probably because of the existence of a flowbit in the rule. You
> >> disable it, however, PulledPork checks/verifies flowbits, and will re-enable
> >> rules based on that. Can you run your PulledPork command with -v to output
> >> in verbose mode? If there is a flowbit conflict with your rule disablement,
> >> it will show up in PulledPork output.
> >>
> >> YM
> >>
> >
> > Oops .. You are right YM:
> >
> > Cleanup....
> > removed 55 temporary snort files or directories from /tmp/tha_rules!
> > Processing /data/config/etc/idpsuricata02/pulledpork/disablesid.conf....
> > Disabled 1:2009005
> > Disabled 1:2011582
> > Modified 2 rules
> > Done
> > Setting Flowbit State....
> > WARN - 1:2011582 is re-enabled by a check of the
> > ET.http.javaclient.vulnerable flowbit!
> > Enabled 39 flowbits
> > Done
> > Writing rules to unique destination files....
> > Writing rules to /data/config/etc/idpsuricata02/rules/
> > Done
> > Generating sid-msg.map....
> > Done
> > Writing v1 /data/config/etc/idpsuricata02/sid-msg.map....
> > Done
> > Fly Piggy Fly!
> >
> > Uhmm .. How can I avoid this situation??
> 

> 
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/NeoTech
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> 
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140414/142a7a44/attachment.html>


More information about the Snort-users mailing list