Snort mailing list archives
Re: modifying priority on certain rules
From: sekure <sekure () gmail com>
Date: Tue, 21 Feb 2006 16:59:27 -0500
Try oinkmaster On 2/21/06, Christina McAghon <cmcaghon () sungardsct com> wrote:
I am running snort v2.3.3. I would like to change the priority of a few certain rules (without affecting the default classification.config priority). I thought I could achieve this by copying the rule from its rule file into local.rules. In local.rules, I added the priority classification. Here's an example: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; priority:2; sid:2466; rev:7;) The problem is that this rule doesn't trigger. If I modify the rule to not include the sid and rev, it will trigger: alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc; classtype:protocol-command-decode; priority:2;) However, I would like to keep the sid information. Is that possible? Or is there a better way to achieve this? Thanks, Christina
------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://sel.as-us.falkag.net/sel?cmd=lnk&kid3432&bid#0486&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- modifying priority on certain rules Christina McAghon (Feb 21)
- Re: modifying priority on certain rules sekure (Feb 21)
- Re: modifying priority on certain rules Andreas Östling (Feb 21)
- Re: modifying priority on certain rules Christina McAghon (Feb 21)
- Re: modifying priority on certain rules Andreas Östling (Feb 22)
- Re: modifying priority on certain rules Dirk Geschke (Feb 22)
- Re: modifying priority on certain rules Christina McAghon (Feb 21)
- <Possible follow-ups>
- Re: modifying priority on certain rules Christina McAghon (Feb 22)
- Re: modifying priority on certain rules Frank Knobbe (Feb 22)