RE: Good Snort Signatures <-- is all in tuning

[Josh Berry <jberry () penson com>]

I have been playing around with a couple perl scripts that take Active
Nessus scans and passive p0f information and reconfigure snort on the
fly.  They are very basic and I actually need help with one particular
aspect.

Basically, the perl script tails p0f output and looks for unique
networks and IP addresses and updates a database with their current OS
and running applications (using p0f in SYN/ACK mode).  I then use the
unique networks profile to populate the HOME_NET variable, and the
unique IP's/services to populate other variables (I created variables
for most of the service type rules, ie DNS_SERVERS, WIN_IIS_SERVERS,
FINGER_SERVERS, IMAP_SERVERS, etc.).  I use oinkmaster to change the
HOME_NET variable in the dns.rules file to DNS_SERVERS (and do the same
for all other rule sets).  It then takes every IP address that has been
seen responding with a SYN/ACK from port 110 and sticks them in the
POP3_SERVERS variable (and does the same for all the other variable
types).

What I would like to do is get rid of p0f and have a perl script that
does the fingerprinting, populates the database, and reconfigures
snort.  I also need to implement some sort of cache function so that
IP's and services that have already been seen are not looked up in the
database.

I am not much of a developer so if anyone is interested in helping out
let me know.

On Tue, 2004-08-24 at 21:03, Adriel T. Desautels wrote:
>  -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Patrick et All,
>       This is what I had suspected all along but wanted to check my
> thoughts against you folks. I heard rumors about "better rules" or
> "more well written rules" but have never seen such rule sets. My next
> adventure, does anyone know of a utility which will configure snort
> rules automatically based on a detected network configuration? If so,
> please let me know. 
>
>
> Adriel T. Desautels
> Founder and CTO
> Secure Network Operations
> Embracing the future of technology, protecting you.
> Office:  978-263-3829    Fax: 978-263-3313
> atd () secnetops com      www.secnetops.com  
>
> - -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Patrick
> S. Harper
> Sent: Tuesday, August 24, 2004 8:31 PM
> To: atd () secnetops com; snort-users () lists sourceforge net
> Subject: RE: [Snort-users] Good Snort Signatures
>
> I believe the problem is not in the rules but in the tuning.  It is
> not an hour or two process for ANY ids.  I have worked with most of
> the major versions in the last 5 years and even worked as an SE for
> one of the manufactures.
>
> I find that a lot of people just install snort, crank it up, open
> acid and get overwhelmed.  You have variables to define, and you need
> to do all of them nit just home and external net.  Then you need to
> go through and get rid of the rules that do not mean anything to you.
>
> Patrick S. Harper | CISSP RHCT MCSE
> www.internetsecurityguru.com
>
> www.ntsug.org - Snort Users Group
>
> "If there is no light at the end of the tunnel, get down there and
> light the damn thing yourself!"
>  
> - -----Original Message-----
> From: snort-users-admin () lists sourceforge net
> [mailto:snort-users-admin () lists sourceforge net] On Behalf Of Adriel
> T.
> Desautels
> Sent: Tuesday, August 24, 2004 12:57 PM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Good Snort Signatures
>
> Greetings List, 
>       Does anyone here know where I can find low false positive snort
> rules?  The rules from snort.org are simply bunk.  They generate way
> too many false positives and even false negatives during certain
> types of events. I am not adverse to purchasing snort rules either, I
> just need something that works.
>
>
>
> - -------------------------------------------------------
> SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank
> Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only
> $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
> http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
>
> - -------------------------------------------------------
> SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank
> Media 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only
> $33 Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
> http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.1
>
> iQA/AwUBQSvzYbR5YB3MHZrzEQLQPgCfaDkmLwANLp709ruHy+qcMnMpogQAnA3X
> yLmEKnRaNypwDPn/ApxaZN/V
> =vo/A
> -----END PGP SIGNATURE-----
>
>
>
> -------------------------------------------------------
> SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
> 100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
> Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
> http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- 


Josh Berry, CISSP & MCSE
Network Security Engineer
214-765-1296

--------------------------------------------------------------------
If you spend more on coffee than on IT security, you will be hacked.
What's more, you deserve to be hacked.
        -- (Former) White House Cybersecurity adviser Richard Clarke


-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users