Re: Creating a simple rule.

[Jason Brvenik <jasonb () sourcefire com>]

Content only operates on the payload section of tcp and the content you
are looking for is not in the payload.

0000  00 01 80 3b 0a 93 08 00 20 9f f9 5d 08 00       = ethernet header

0000                                            45 00
0010  00 28 3f e3 40 00 38 06 8e 58 8e e3 25 07 c0 a8   
0020  00 02                                           = IP header

0200        06 bb 09 7c 86 7b 29 36 00 00 00 00 50 04 
0030  00 00 7b 63                                     = TCP Header

0300              00 00 55 55 55 55 55 55             = payload

 


Paul Halliday wrote:

> The Packet:
>
> Transmission Control Protocol, Src Port: pptp (1723), Dst Port: 2428
> (2428), Seq: 190, Ack: 2594307140, Len: 0
>    Source port: pptp (1723)
>    Destination port: 2428 (2428)
>    Sequence number: 190    (relative sequence number)
>    Header length: 20 bytes
>    Flags: 0x0004 (RST)
>        0... .... = Congestion Window Reduced (CWR): Not set
>        .0.. .... = ECN-Echo: Not set
>        ..0. .... = Urgent: Not set
>        ...0 .... = Acknowledgment: Not set
>        .... 0... = Push: Not set
>        .... .1.. = Reset: Set
>        .... ..0. = Syn: Not set
>        .... ...0 = Fin: Not set
>    Window size: 0
>    Checksum: 0x7b63 [correct]
>
> 0000  00 01 80 3b 0a 93 08 00 20 9f f9 5d 08 00 45 00   ...;.... ..]..E.
> 0010  00 28 3f e3 40 00 38 06 8e 58 8e e3 25 07 c0 a8   .(?.@.8..X..%...
> 0020  00 02 06 bb 09 7c 86 7b 29 36 00 00 00 00 50 04   .....|.{)6....P.
> 0030  00 00 7b 63 00 00 55 55 55 55 55 55               ..{c..UUUUUU
>
> The Rule:
>
> alert tcp any any -> any any (msg:"PPTP: Connection Failed";
> content:"|00 50 04|"; classtype:misc-activity; sid:1000001; rev:1;)
>
> I know it shouldn't be 'any any' but I was trying to eliminate
> possibilities as to why it wouldn't work. This also probably isn't the
> best way to track this; I was just looking at the bleeding ssh
> connection rule, and it uses flags. I am just playing around.
>
> Thanks.
>
> On 11/19/05, Jason Brvenik <jasonb () sourcefire com> wrote:
>  
>
> > On it's face that should work but there could be a number of problems
> > with the rule or the packet. Can you provide the actual packet and rule
> > you are testing with?
> >
> >
> > Paul Halliday wrote:
> >    
> >
> > > I am just trying to make a couple simple rules but they fail to fire.
> > >
> > > Can someone just clarify this:
> > >
> > > I am looking at a TCP packet with ethereal that looks like this:
> > >
> > > 06 bb 09 75 74 0c e2 c4 00 00 00 00 50 04 00 00 d4 4a 00
> > >
> > > I want the rule to fire on the pattern 00 50 04
> > >
> > > I have a rule that looks like:
> > >
> > > content:"|00 50 04|"
> > >
> > > yet it doesnt fire. Is there something that I have missed?
> > >
> > > Thanks.
> > >
> > >
> > > -------------------------------------------------------
> > > This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
> > > Register for a JBoss Training Course.  Free Certification Exam
> > > for All Training Attendees Through End of 2005. For more info visit:
> > > http://ads.osdn.com/?ad_idv28&alloc_id845&op=click
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list=ort-users
> > >
> > >      
>
>
> --
> _________________
> Paul Halliday
> http://pintumbler.com/
>
> "Diplomacy is the art of saying "Nice doggie!" till you can find a rock."
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
> Register for a JBoss Training Course.  Free Certification Exam
> for All Training Attendees Through End of 2005. For more info visit:
> http://ads.osdn.com/?ad_idv28&alloc_id845&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=ort-users
>
>  



-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users