Snort mailing list archives

Snort Alerting Question


From: "ACiD" <ACiD-0 () comcast net>
Date: Wed, 29 Oct 2003 19:58:56 -0500

I am having a problem figuring why a certain packet will not alert under
snort.  Below is one such (malformed) packet. Any assistance is greatly
appreciated and thanks in advance.

Standard Rule (from default chat.rules):
alert tcp $HOME_NET any <> $EXTERNAL_NET 1863 (msg:"CHAT MSN message";
flow:established; content:"MSG "; depth:4; content:"Content-Type\:";
content:"text/plain"; distance:1; classtype:misc-activity; sid:540;
rev:8;)

Malformed Packet:
05:22:53.884488 xxx.xxx.xxx.xxx.61924 > yyy.yyy.yyy.yyy.1863: P [bad tcp
cksum 4040!] 245:384(139) ack 1 win 16482 (DF) (ttl 122, id 127, len
179, bad cksum ff2a!)
0x0000   4500 00b3 007f 4000 7a06 ff2a 8a61 1258        E.....@.z..*.a.X
0x0010   4004 0c9e f1e4 0747 46f1 28b3 359a 173d        @......GF.(.5..=
0x0020   5018 4062 37b4 0000 4d53 4720 3520 4e20        P. () b7   MSG.5.N.
0x0030   3132 360d 0a4d 494d 452d 5665 7273 696f        126..MIME-Versio
0x0040   6e3a 2031 2e30 0d0a 436f 6e74 656e 742d        n:.1.0..Content-
0x0050   5479 7065 3a20 7465 7874 2f70 6c61 696e        Type:.text/plain
0x0060   3b20 6368 6172 7365 743d 5554 462d 380d        ;.charset=UTF-8.
0x0070   0a58 2d4d 4d53 2d49 4d2d 466f 726d 6174        .X-MMS-IM-Format
0x0080   3a20 464e 3d4d 5325 3230 5368 656c 6c25        :.FN=MS%20Shell%
0x0090   3230 446c 673b 2045 463d 3b20 434f 3d30        20Dlg;.EF=;.CO=0
0x00a0   3b20 4353 3d30 3b20 5046 3d30 0d0a 0d0a        ;.CS=0;.PF=0....
0x00b0   7965 73                                        yes

I just cannot figure out why Snort will not alert on the packet.  I
understand that the tcp checksum is bad, therefore I am using the -k
none option.  The depth:4 should catch the MSG

Any ideas ???




Current thread: