Re: pass rules for one alert

[Chris Green <cmg () sourcefire com>]

TheEagleSociety () netscape net (Night-Stalker) writes:

> Hello John,
>
> the Payload, that snort logs looks like this:
>
>   length = 131
>   LIST..PASV..CDW //directory1/directory2..LIST..PASV..
>   CWD //directory3/directory4..LIST..PASV..
>
> As I can see, it must be hourly cron-job from host1 to host2 via
> FTP. Every hour, I get 5 false positives of this alert. Only between
> these hosts. My pass-rule, I wrote below doesn't work, or it works but
> also triggers the alert-rule. As I wrote, I only want to ignore this
> false positive between these hosts and I dont't want to comment out
> the complete alert-rule to ignore all these alerts. I also don't want
> to write a pass-rule to ignore the complete FTP-Transfers between
> these hosts.  Can anybody help me out?

Update to 1.9. The dsize check now returns 0 on rebuilt stream packets.
-- 
Chris Green <cmg () sourcefire com>
Fame may be fleeting but obscurity is forever.


-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users