RE: accuracy of snort?

["Sloan, Craig" <CSloan () WITTMANN-CT com>]

I have seen this on numerous occasions, and upon examining the packet it is
always a email from one of the many lists I subscribe to. Within the message
is the word "help" i.e.:Code Red HELP!!!

As mentioned in other posts, the accuracy of any IDS is subject to our
ability  to tune it, becoming familiar with our own traffic, and also
becoming intimate with the IDS package itself.

SNORT for me became accurate after quite some time of tweaking and chasing
down false positives, false negatives and real attempts.

Craig Sloan

-----Original Message-----
From: Pontus Joakimsson [mailto:jpontus () ess nec de]
Sent: Wednesday, August 08, 2001 5:45 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] accuracy of snort?


How accurate is the alerts in snort?

found this in the logs this morning... how seriously should i take it?
(there were only one incident from this host)

-----------------------------------------------------
[**] [1:657:2] SMTP chameleon overflow [**]
[Classification: Attempted Administrator Privilege Gain] [Priority: 10]
08/08-07:45:51.102745 209.246.10.170:64062 -> x.x.x.x:25
TCP TTL:231 TOS:0x0 ID:47600 IpLen:20 DgmLen:1420
***A**** Seq: 0x569FF343  Ack: 0x84528B3E  Win: 0x25BC  TcpLen: 20
[Xref => http://www.securityfocus.com/bid/2387]
[Xref => http://www.whitehats.com/info/IDS266]
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-1999-0261]
-----------------------------------------------------

Regards,
  Pontus Joakimsson

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users