IDS mailing list archives
Re: SMTP traffic
From: Jose Nazario <jose () monkey org>
Date: Tue, 3 Jul 2007 13:55:09 -0400 (EDT)
On Sun, 2 Jul 2007, bron () gmail com wrote:
I am sort of new to IDS. I am writing rule for IPS. If i have a rule which requires monitoring the argument of Mail From : SMTP command, then it may happen that my rule can get triggered inside the body of emails giving me false positives.
Any suggestions how can i remove such false positives ?
if your IDS doesn't keep track of the SMTP dialogue (IIRC NFR used to, as an example), you can specify a maximum search depth for the MAIL FROM command. alternatively, if you have to write regular expressions, you can enforce the MAIL FROM command coming after the HELO or EHLO command and before the RCPT TO command. the regex's get a bit hairy there, though.
hope that helps. ________ jose nazario, ph.d. jose () monkey org http://monkey.org/~jose/ http://monkey.org/~jose/secnews.html http://www.wormblog.com/ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly?Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more.
------------------------------------------------------------------------
Current thread:
- SMTP traffic bron (Jul 03)
- Re: SMTP traffic Jose Nazario (Jul 03)
- <Possible follow-ups>
- Re: SMTP traffic max (Jul 03)