Snort mailing list archives
Snort pattern matching weirdness.
From: "larosa, vjay" <larosa_vjay () emc com>
Date: Thu, 6 Mar 2003 09:19:17 -0500
O.Kay, I just upgraded to Snort 1.9.1 last night. Since then I have been getting tons of events for a couple snort rules I wrote a while back to detect the Fun Love virus crossing the network. Below is an example rule I wrote which is having this problem. alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS Fun Love flcss.exe"; flags: A+; content: "|66 6c 63 73 73 2e 65 78 65|"; classtype:string-detect; rev:1;) This is the payload from one of the packets that tripped this rule. I have been getting tons of these. Since I upgraded. I can't for the life of me figure out how the data from this packet tripped this rule. Does anybody have any ideas? Is anybody else seeing rules triggered even though packet payloads are not correctly matched in the rule that identified them? This is not the only rule that I have that is doing this either, I know of a second rule that is tripping when the data pattern does not match. Please help!! AC 27 DC BB F0 DE 81 EC 4B 25 84 F3 BA 04 61 D7 .'......K%....a. C9 7A 4E 28 38 98 F3 45 91 6B 97 B8 05 C5 75 F0 .zN(8..E.k....u. 72 B5 4D 82 F5 B4 29 B7 13 EB 4C 2E DF DC 46 F6 r.M...)...L...F. FC 0F E2 16 85 EB E4 34 97 15 5C 4F 07 F7 C5 DE .......4..\O.... C8 ED E5 5C 2C B1 20 97 21 2D 70 1B 24 2E 2F 70 ...\,. .!-p.$./p 1B 25 AE 2A 70 B2 DF F4 33 8A FC E6 3A 82 FD E9 .%.*p...3...:... 02 77 41 C1 CD 2B B8 4B 0A 6E 41 C1 2D 2A B8 37 .wA..+.K.nA.-*.7 15 DC 95 8E 60 BF BF C0 2D 75 04 FB C2 04 EE 9D ....`...-u...... 0E BF 2F CC A3 95 FC 0B 47 8B 85 63 CC 73 10 7B ../.....G..c.s.{ B6 CA 3E 8A 9A DD 9B 2B F7 8D 54 2C C2 42 86 E7 ..>....+..T,.B.. 92 28 FF F4 D1 8A 73 32 F1 84 E3 4E 1F B5 67 8E .(....s2...N..g. 15 0B 39 A5 0A 9E EF A2 26 7D 71 C5 F9 D3 04 AD ..9.....&}q..... AA 75 3B D9 AF 8E 6F A8 9C 67 B3 DC A6 06 AB A4 .u;...o..g...... 43 D6 65 C3 FF 5D D0 81 5B 12 71 58 24 FE B0 AC C.e..]..[.qX$... 5F B0 9C 92 55 A4 91 EB 99 DF 49 DE 9E F1 B4 A2 _...U.....I..... 8C 59 4C 9E EB 9D E4 C9 2D C6 15 65 5B 8B BC 3A .YL.....-..e[..: E5 DD 11 83 0D 7B 96 03 2E F5 FA 7E 19 7F 2F 24 ....{.....~./$ 8C F3 41 63 75 33 FF 7F AF D2 3E 67 D0 07 C4 CB ..Acu3...>g.... F4 BB 68 B8 70 FF 7F F2 3A C1 1D DF 9F 33 74 32 ..h.p..:....3t2 90 CF B9 4E DC B1 2A 4D 42 6B CF A3 26 63 FA AD ...N..*MBk..&c.. E7 E5 73 9B E6 0B E5 79 35 1B CF 3F 2C 2F EC 41 ..s....y5..?,/.A 2B B9 03 1A 3A DB AA D4 27 5F 02 BF 9B CF 9C 12 +...:...'_...... FE 20 70 37 75 70 AB EE ED AA B0 2A F9 F3 39 E2 . p7up.....*..9. DD AC 83 69 3A 1D 6C 92 BF F8 2C B8 2E D8 0D B2 ...i:.l...,.... CD B4 AC E0 60 03 60 33 AE 5D C1 45 15 5C B7 82 ....`.`3.].E.\.. 8B 29 B8 1E 05 97 50 70 7B 14 5C 52 C1 1D 54 70 .)....Pp{.\R..Tp 69 05 37 AE E0 26 3A EB 36 9A CC 4D 09 D7 C9 F6 i.7..&:.6..M.... B0 AD E0 AA 42 9A 32 37 DB C9 D6 84 92 89 58 43 ....B.27......XC 7E 67 3A D9 9E CD 20 EE DB 9D 6C 7F 67 10 F7 5A ~g:... ...lg..Z 4D 97 46 EE A2 E2 BA 5F 28 AE FB 95 42 CF DF 76 M.F...._(...B..v F2 F9 61 23 F7 67 C5 75 D7 3A F9 9C A5 91 FB 8F ..a#.g.u.:...... E2 BA D6 68 F3 32 44 A3 EC 35 BA 20 6E 6B 94 CD ...h.2D..5. nk.. 9D 83 B8 A7 A3 98 5F AC 91 3B 20 A4 29 DB FB E3 ......_..; .)... 0A EE 8B 42 7E 32 F7 D5 28 1B CF 83 B8 73 8A 34 ...B~2..(....s.4 7F 18 C5 F9 7D 00 F7 6B C5 75 57 A2 78 2F C5 1A ...}..k.uW.x/.. B9 6B 42 9A F2 FD 19 EE AA 97 41 E6 B6 74 61 3B .kB.......A..ta; C4 1A B9 6D 5D 6C 2D 02 AE 93 E7 41 03 5D 75 5D ...m]l-....A.]u] 3A 02 56 6D 59 BB 27 7C 73 E3 30 86 37 E3 BA 05 :.VmY.'|s.0.7... 6E 9D C4 6D 6B C2 F1 0D 0F 60 63 24 E7 92 BE F5 n..mk...`c$.... 8B 08 86 C3 CF 7E C9 79 FF 3C DD 10 ED 3A 69 7E .....~.y.<...:i~ 68 88 EB 3A 01 5C 54 C1 75 2B B8 98 82 EB 51 70 h..:.\T.u+....Qp 09 05 B7 87 04 CF 63 0D 5C 2B 0A 9A C7 1A F8 7B ......c\+.....{ B5 38 8F 15 B9 34 09 7E B6 1A B8 0E D8 8C 9B 50 .8...4.~.......P 70 53 0A CE 56 70 55 05 37 AB E0 4E 2B B8 B3 0A pS..VpU.7..N+... EE 9C 82 9B 53 70 17 14 DC BC 82 BB A4 E0 16 48 ....Sp.........H F0 38 66 E0 BB 09 41 63 95 81 EF 06 35 E3 AE 90 .8f...Ac....5... E0 71 CC A8 AD 83 43 3F 4A 2C B4 49 DC 3B D8 FF .q....C?J,.I.;.. 66 29 27 F7 A3 F7 79 7B 50 AE 55 E2 96 05 2E 22 f)'...y{P.U...." 71 37 04 CE 90 FB 66 A8 CE B5 C8 7D 33 C4 CA 30 q7....f....}3..0 3B 97 5C E8 94 FB 66 13 8E A7 31 8E EB AA 44 E2 ;.\...f...1...D. E0 DE 3D 1B 69 E4 5A E9 9F 8D 21 3E 9B 61 F6 21 ..=.i.Z...!>.a.! BC EB BD 2E C4 9E 4C 3C 0C FA 28 0B 8B D4 C2 E0 ......L<..(..... 1D EE F5 21 A6 19 0F 83 F7 B5 59 BC 96 5A 18 BC ...!......Y..Z.. 9B DD 1E 6E B4 57 57 FE 0B 60 73 DC 7C F7 E6 BB ...n.WW..`s.|... FC 77 67 DF 0F 94 F5 23 6C DA E8 F7 16 5A 4C BD .wg....#l....ZL. 2D F5 36 70 BB F3 FF B0 9E FF EB F9 BF 9E FF AF -.6p............ F9 F9 3F 3F FF 0B FA D1 A3 6F 1C EE FF C6 BF 16 ..??.....o...... 0F 9C FE E9 8F BE B6 EB E2 7F DF B8 D5 F3 BF F4 ............... F9 3F 1A 1A 6B 0B B7 7A FE 97 81 36 00 D8 C9 1F .?..k..z...6.... 23 FA FC 2F 0D 8D B5 8C 8F EB 2A D0 D0 D0 D0 D0 #../.....*..... D0 D0 D0 D0 D0 B8 6F B0 52 FF 5F 9F 27 6C FF 2E ......o.R._.'l.. 60 5C 57 9B 86 C6 3D 81 FF 03 40 D9 1B D5 F3 23 `\W...=...@....# 00 80 43 4B EC 9D 0F 70 94 65 7E C7 DF DD 6C 20 ..CK...p.e~...l 39 A0 2E 16 AE C1 03 6F 83 49 0C C8 9F 05 01 03 9......o.I...... 82 79 43 08 26 0A B8 01 02 C1 62 D9 85 AC 24 1A .yC.&.....b...$. 60 09 E1 06 3A D2 6E 10 7A A1 D5 36 CC C1 14 5B `...:.n.z..6...[ B9 6E EE A0 A2 05 DD 58 39 E1 04 6F 41 81 80 44 .n.....X9..oA..D 37 40 14 14 CE C5 81 19 EC C8 4C 98 91 0E CE 48 7@........L....H DB EF EF 7D BE 9B DD 25 9B 64 E1 EC 4D AB FB 4E ...}...%.d..M..N BE FB 79 B3 FB BC CF FB FC FF F7 3E EF F3 44 FC ..y........>..D. 90 DC 07 2C 79 24 8F 1F DE FE 5F C6 21 C3 F5 C9 ...,y$...._.!... 7D C0 92 47 F2 F8 01 EE FF 75 9A FB 7F AD CB 6A }..G.....u....j 79 EE 3F 97 14 16 3D DF 76 6A 6A F9 D7 CF 9F 4C y.?...=.vjj....L EE FF 95 3C 92 C7 F7 FB E8 C3 7E 7D F8 F9 FF 22 ...<......~}..." 6E F2 3D E2 5E 4D 5B C8 F7 E3 E5 19 FF E0 FB D0 n.=.^M[......... 43 A8 D4 B4 79 5A 64 FF AF 87 79 CD 44 68 12 F4 C...yZd...y.Dh.. 90 A6 D6 12 9B 02 3D 02 E5 6B 6A 0E B7 2C 56 21 ......=..kj..,V! CB AE 14 6A 6A 2E 61 11 34 1D 7A 54 53 F3 B8 4B ...jj.a.4.zTS..K 34 75 FF C7 35 B5 5E 96 AC 2B 34 0B 7A 42 53 73 4u..5.^..+4.zBSs 10 4A A1 D9 90 8C 47 C8 1A 65 B7 CE 2F 10 3F C8 .J....G..e../.?. FC 02 99 67 20 F3 0B EE A2 9B 65 51 06 99 97 20 ...g .....eQ... EF 15 C8 BC 04 99 AF 20 73 17 E4 99 A7 CC 73 97 ....... s.....s. 79 8C B2 E4 B0 EC 6D 2E 73 17 86 68 B2 1E 9D A6 y.....m.s..h.... FD 54 53 73 DD 33 35 59 1B 45 D3 E0 75 63 FE BE .TSs.35Y.E..uc.. AC 31 90 03 DD AF A9 F9 EE C3 A0 E1 90 6C 2D 20 .1...........l- EF C4 CB F2 E7 B2 05 C1 68 4D CD 19 1C 03 8D 85 ........hM...... 1E 84 C6 69 6A 3E ED 84 64 92 4B 1E FF 87 0E A9 ...ij>..d.K..... BD 4F 73 FE DF AD F5 7F D8 4C 72 FF AF E4 91 3C .Os.....Lr....< BE 9F 47 72 FF AF E4 91 3C 7E B8 47 78 BD AE BE ..Gr....<~.Gx... 68 F8 FA 0F 75 AE EE A3 F7 F3 1A 7A C9 E4 6F 0C h...u......z..o. 59 4C 8F D4 05 BA 5C 89 36 38 5E D1 3A 81 EF DC YL....\.68^.:... B3 C1 AB 4F ...O vjl V.Jay LaRosa EMC Corporation Information Security 4400 Computer Dr. (508)898-7433 office Westboro, MA 01580 (508)353-1348 cell www.emc.com 888-799-9750 pager larosa_vjay () emc com ------------------------------------------------------- This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger for complex code. Debugging C/C++ programs can leave you feeling lost and disoriented. TotalView can help you find your way. Available on major UNIX and Linux platforms. Try it free. www.etnus.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort pattern matching weirdness. larosa, vjay (Mar 06)
- <Possible follow-ups>
- RE: Snort pattern matching weirdness. larosa, vjay (Mar 06)
- RE: Snort pattern matching weirdness. larosa, vjay (Mar 07)