Snort mailing list archives
Snort Alerting Question
From: "ACiD" <ACiD-0 () comcast net>
Date: Wed, 29 Oct 2003 19:58:56 -0500
I am having a problem figuring why a certain packet will not alert under snort. Below is one such (malformed) packet. Any assistance is greatly appreciated and thanks in advance. Standard Rule (from default chat.rules): alert tcp $HOME_NET any <> $EXTERNAL_NET 1863 (msg:"CHAT MSN message"; flow:established; content:"MSG "; depth:4; content:"Content-Type\:"; content:"text/plain"; distance:1; classtype:misc-activity; sid:540; rev:8;) Malformed Packet: 05:22:53.884488 xxx.xxx.xxx.xxx.61924 > yyy.yyy.yyy.yyy.1863: P [bad tcp cksum 4040!] 245:384(139) ack 1 win 16482 (DF) (ttl 122, id 127, len 179, bad cksum ff2a!) 0x0000 4500 00b3 007f 4000 7a06 ff2a 8a61 1258 E.....@.z..*.a.X 0x0010 4004 0c9e f1e4 0747 46f1 28b3 359a 173d @......GF.(.5..= 0x0020 5018 4062 37b4 0000 4d53 4720 3520 4e20 P. () b7 MSG.5.N. 0x0030 3132 360d 0a4d 494d 452d 5665 7273 696f 126..MIME-Versio 0x0040 6e3a 2031 2e30 0d0a 436f 6e74 656e 742d n:.1.0..Content- 0x0050 5479 7065 3a20 7465 7874 2f70 6c61 696e Type:.text/plain 0x0060 3b20 6368 6172 7365 743d 5554 462d 380d ;.charset=UTF-8. 0x0070 0a58 2d4d 4d53 2d49 4d2d 466f 726d 6174 .X-MMS-IM-Format 0x0080 3a20 464e 3d4d 5325 3230 5368 656c 6c25 :.FN=MS%20Shell% 0x0090 3230 446c 673b 2045 463d 3b20 434f 3d30 20Dlg;.EF=;.CO=0 0x00a0 3b20 4353 3d30 3b20 5046 3d30 0d0a 0d0a ;.CS=0;.PF=0.... 0x00b0 7965 73 yes I just cannot figure out why Snort will not alert on the packet. I understand that the tcp checksum is bad, therefore I am using the -k none option. The depth:4 should catch the MSG Any ideas ???
Current thread:
- Snort Alerting Question ACiD (Oct 30)
