Re: Creating a simple rule.

[snort user <snort.user () gmail com>]

Okay.

Not it makes sense. The content that you are trying to match is part of the
TCP header. The tcp payload of this packet is
55 55 55 55 55 55

Since it is a PPTP connection failed, you could try to match the TCP RST
flag, and src port 1723.

Enjoy !

On 11/19/05, Paul Halliday <paul.halliday () gmail com> wrote:
> The Packet:
>
> Transmission Control Protocol, Src Port: pptp (1723), Dst Port: 2428
> (2428), Seq: 190, Ack: 2594307140, Len: 0
> Source port: pptp (1723)
> Destination port: 2428 (2428)
> Sequence number: 190 (relative sequence number)
> Header length: 20 bytes
> Flags: 0x0004 (RST)
> 0... .... = Congestion Window Reduced (CWR): Not set
> .0.. .... = ECN-Echo: Not set
> ..0. .... = Urgent: Not set
> ...0 .... = Acknowledgment: Not set
> .... 0... = Push: Not set
> .... .1.. = Reset: Set
> .... ..0. = Syn: Not set
> .... ...0 = Fin: Not set
> Window size: 0
> Checksum: 0x7b63 [correct]
>
> 0000 00 01 80 3b 0a 93 08 00 20 9f f9 5d 08 00 45 00 ...;.... ..]..E.
> 0010 00 28 3f e3 40 00 38 06 8e 58 8e e3 25 07 c0 a8 .(?.@.8..X..%...
> 0020 00 02 06 bb 09 7c 86 7b 29 36 00 00 00 00 50 04 .....|.{)6....P.
> 0030 00 00 7b 63 00 00 55 55 55 55 55 55 ..{c..UUUUUU
>
> The Rule:
>
> alert tcp any any -> any any (msg:"PPTP: Connection Failed";
> content:"|00 50 04|"; classtype:misc-activity; sid:1000001; rev:1;)
>
> I know it shouldn't be 'any any' but I was trying to eliminate
> possibilities as to why it wouldn't work. This also probably isn't the
> best way to track this; I was just looking at the bleeding ssh
> connection rule, and it uses flags. I am just playing around.
>
> Thanks.
>
> On 11/19/05, Jason Brvenik <jasonb () sourcefire com> wrote:
> > On it's face that should work but there could be a number of problems
> > with the rule or the packet. Can you provide the actual packet and rule
> > you are testing with?
> >
> >
> > Paul Halliday wrote:
> > > I am just trying to make a couple simple rules but they fail to fire.
> > >
> > > Can someone just clarify this:
> > >
> > > I am looking at a TCP packet with ethereal that looks like this:
> > >
> > > 06 bb 09 75 74 0c e2 c4 00 00 00 00 50 04 00 00 d4 4a 00
> > >
> > > I want the rule to fire on the pattern 00 50 04
> > >
> > > I have a rule that looks like:
> > >
> > > content:"|00 50 04|"
> > >
> > > yet it doesnt fire. Is there something that I have missed?
> > >
> > > Thanks.
> > >
> > >
> > > -------------------------------------------------------
> > > This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
> > > Register for a JBoss Training Course. Free Certification Exam
> > > for All Training Attendees Through End of 2005. For more info visit:
> > > http://ads.osdn.com/?ad_idv28&alloc_id845&op=click
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list=ort-users
>
>
> --
> _________________
> Paul Halliday
> http://pintumbler.com/
>
> "Diplomacy is the art of saying "Nice doggie!" till you can find a rock."
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
> Register for a JBoss Training Course. Free Certification Exam
> for All Training Attendees Through End of 2005. For more info visit:
> http://ads.osdn.com/?ad_idv28&alloc_id845&opclick
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?listsnort-users