Re: fast_pattern not always longest content string by default?

["Josh Rosenbaum (jrosenba)" <jrosenba () cisco com>]

Hi Mike,

Sorry for this unfortunate news, but it looks like you will need tweak those sigs.  I can confirm that if a 
fast_pattern keyword is not specified for a given rule, the default fast pattern is the longest HTTP buffer content.   
If no HTTP buffer content is present, then the fast pattern is the longest content.

Josh


From: Mike Cox <mike.cox52 () gmail com<mailto:mike.cox52 () gmail com>>
Date: Wednesday, October 22, 2014 at 8:16 AM
To: "snort-devel () lists sourceforge net<mailto:snort-devel () lists sourceforge net>" <snort-devel () lists 
sourceforge net<mailto:snort-devel () lists sourceforge net>>
Subject: [Snort-devel] fast_pattern not always longest content string by default?

Hi All,

I was looking thru some of my sigs with 'debug-print-fast-pattern' turned on and noticed that the fast pattern string 
was not always the longest content match by default.  Specifically, it appears that content matches in (valid for 
fast_pattern) HTTP Inspect buffers (e.g. http_header, http_uri, etc.) are taking priority.  For example, consider this 
sig:

alert tcp any any -> any $HTTP_PORTS (msg:"FP Test"; flow:established,to_server; 
content:"twitter.com<http://twitter.com>"; http_header; content:"hellow Twitter tweet"; sid:1234567;)

The longest content match is "hellow Twitter tweet" but when I look at the fast pattern debug output, the fast pattern 
used is "twitter.com<http://twitter.com>".

Having the HTTP Inspect buffers take priority makes sense because they will be smaller than the entire packet and thus 
more efficient.  However, I do not see this behavior documented in the manual which says, "the default behavior of fast 
pattern determination is to use the longest content in the rule..."

Can someone comment/confirm this?  It is looking like I may have to review/tweak a plethora of sigs.... :(

Thanks!

-Mike Cox

------------------------------------------------------------------------------

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!