Snort mailing list archives
modifying priority on certain rules
From: Christina McAghon <cmcaghon () sungardsct com>
Date: Tue, 21 Feb 2006 15:50:29 -0500
I am running snort v2.3.3. I would like to change the priority of a few
certain rules (without affecting the default classification.config
priority). I thought I could achieve this by copying the rule from its
rule file into local.rules. In local.rules, I added the priority
classification. Here's an example:
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$
unicode share access"; flow:established,to_server; content:"|00|";
depth:1; content:"|FF|SMBu"; within:5; distance:3;
byte_test:1,&,128,6,relative; pcre:"/^.{27}/R";
byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|";
distance:2; nocase; flowbits:set,smb.tree.connect.ipc;
classtype:protocol-command-decode; priority:2; sid:2466; rev:7;)
The problem is that this rule doesn't trigger. If I modify the rule to
not include the sid and rev, it will trigger:
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$
unicode share access"; flow:established,to_server; content:"|00|";
depth:1; content:"|FF|SMBu"; within:5; distance:3;
byte_test:1,&,128,6,relative; pcre:"/^.{27}/R";
byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24 00 00 00|";
distance:2; nocase; flowbits:set,smb.tree.connect.ipc;
classtype:protocol-command-decode; priority:2;)
However, I would like to keep the sid information. Is that possible? Or
is there a better way to achieve this?
Thanks,
Christina
Current thread:
- modifying priority on certain rules Christina McAghon (Feb 21)
- Re: modifying priority on certain rules sekure (Feb 21)
- Re: modifying priority on certain rules Andreas Östling (Feb 21)
- Re: modifying priority on certain rules Christina McAghon (Feb 21)
- Re: modifying priority on certain rules Andreas Östling (Feb 22)
- Re: modifying priority on certain rules Dirk Geschke (Feb 22)
- Re: modifying priority on certain rules Christina McAghon (Feb 21)
- <Possible follow-ups>
- Re: modifying priority on certain rules Christina McAghon (Feb 22)
- Re: modifying priority on certain rules Frank Knobbe (Feb 22)
