false positive rules in snort 2.8.6.0

["Lawrence R. Hughes, Sr." <lhughes () safemedia com>]

Hi All,

The following two (2) rules in p2p.rules are false positives... Be aware of the RIAA

drop tcp $HOME_NET 4711 -> $EXTERNAL_NET any (msg:"P2P eDonkey server response"
 flow:established,from_server; content:"Server|3A| eMule";
 fast_pattern:only; metadata:policy security-ips drop;
 reference:url,www.emule-project.net; classtype:policy-violation;
 sid:2587; rev:4;)

drop udp $HOME_NET any -> $EXTERNAL_NET 41170
(msg:"P2P Manolito Search Query"; flow:to_server; content:"|01 02 00 14|";
 depth:4; offset:16; metadata:policy security-ips drop;
 reference:url,openlito.sourceforge.net; reference:url,www.blubster.com;
 classtype:policy-violation; sid:3459; rev:5;)


Thanks,
Larry




------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate 
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the 
lucky parental unit.  See the prize list and enter to win: 
http://p.sf.net/sfu/thinkgeek-promo

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users