Snort mailing list archives
Re: Help with pass rule
From: "prabu" <prabu333 () hotpop com>
Date: Thu, 2 Sep 2004 09:54:09 +0530
Hi, I guess that correct sig_id suppose for thar rule to be 2404,instead of 2405. So the suppress command should be as suppress gen_id 1, sig_id 2404, track by_src, ip 160.214.186.9 instead of; suppress gen_id 1, sig_id 2405, track by_src, ip 160.214.186.9 Cheers, Prabu.S ----- Original Message ----- From: "sekure" <sekure () gmail com> To: "Carlton L. Whitmore" <cwhitmore () advocacyinc org> Cc: <snort-users () lists sourceforge net> Sent: Wednesday, September 01, 2004 11:45 PM Subject: Re: [Snort-users] Help with pass rule
Carlton, A better solution would be to add the following to your threshold.conf: suppress gen_id 1, sig_id 2405, track by_src, ip 160.214.186.9 That way only THAT particular rule will be ignored, but the rest of the traffic between those hosts on those ports will still be analyzed for OTHER exploits.. Read up on suppress and threshold. They offer a much more precise way to deal with unwanted alerts without compromising the visibility into your network. ----- Original Message ----- From: Carlton L. Whitmore <cwhitmore () advocacyinc org> Date: Wed, 1 Sep 2004 11:48:18 -0500 Subject: [Snort-users] Help with pass rule To: snort-users () lists sourceforge net Joel was nice enough to help me with this rule, but it doesn't seem to be blocking the notifications. I put it in the local.rules file and made sure that rule is active in the snort.conf file. I also restarted the snort service. What else do I need to do? ( I'm trying to block these false notifications that are originating from the server 160.214.186.9 to any client ) (here is the notification) EVENT LOG Application EVENT TYPE Information SOURCE snort EVENT ID 1 COMPUTERNAME PE1300 TIME 9/1/2004 11:42:02 AM MESSAGE [1:2404:5] NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt [Classification: Attempted Administrator Privilege Gain] [Priority: 1]: {TCP} 160.214.186.9:2636 -> 160.214.186.45:445 (here is the rule Joel provided) pass tcp 160.214.186.9 any -> $HOME_NET 137:445 (msg:"netbios pass servertoclient";) ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
--- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.747 / Virus Database: 499 - Release Date: 9/1/2004 ------------------------------------------------------- This SF.Net email is sponsored by BEA Weblogic Workshop FREE Java Enterprise J2EE developer tools! Get your free copy of BEA WebLogic Workshop 8.1 today. http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- help with pass rule Scott Elgram (Jul 01)
- Re: help with pass rule sekure (Jul 01)
- Re: help with pass rule Scott Elgram (Jul 01)
- Re: help with pass rule sekure (Jul 01)
- Re: help with pass rule Scott Elgram (Jul 01)
- Re: help with pass rule Scott Elgram (Jul 01)
- Re: help with pass rule sekure (Jul 01)
- Re: help with pass rule Keith W. McCammon (Jul 01)
- <Possible follow-ups>
- Help with pass rule Carlton L. Whitmore (Sep 01)
- Re: Help with pass rule sekure (Sep 01)
- Re: Help with pass rule prabu (Sep 01)
- Re: Help with pass rule sekure (Sep 02)
- Re: Help with pass rule prabu (Sep 02)
- Re: Help with pass rule sekure (Sep 03)
- E-mail alerting Carlos M Ospina (Sep 03)
- Re: E-mail alerting Keith W. McCammon (Sep 03)
- Re: E-mail alerting prabu (Sep 03)
- RE: E-mail alerting Andy (Sep 12)
- Re: E-mail alerting prabu (Sep 13)
- RE: E-mail alerting Andy (Sep 18)
- RE: E-mail alerting Andy (Sep 18)
- Re: Help with pass rule sekure (Sep 01)