Re: flowbits: netsenum

[waldo kitty <wkitty42 () windstream net>]

On 5/30/2013 14:53, Joel Esler wrote:
> On May 30, 2013, at 2:23 PM, waldo kitty <wkitty42 () windstream net
> <mailto:wkitty42 () windstream net>> wrote:
> > On 5/30/2013 07:01, Joel Esler wrote:
> > > On May 29, 2013, at 7:53 PM, waldo kitty<wkitty42 () windstream net
> > > <mailto:wkitty42 () windstream net>> wrote:
> > >
> > > > > > additionally, both existing rules' MSG are identical... one should
> > > > > > speak of "to client" and the other "to server" in the MSG for
> > > > > > clarity??
> > > > >
> > > > > The "set" rule is noalert. You'll never see it alert.
> > > >
> > > > true but perhaps someone sets them to show an alert? ;)
> > >
> > > Is that something you do? I'm not asking that to be a smartass, I'm asking
> > > if that's actually a use case that I haven't studied.
> >
> > we have had some folks do that so they could follow thru with the processing
> > flow and the rules that are seen... it was a mess that some of them regretted
> > having done and a revert of the updater's conf along with a new rules pack
> > download sussed that...
> >
> > at least they were smart enough to also adjust the priority to 5 or higher so
> > the reactive alert blocking mechanism didn't go blocking the entire internet
> > based on them ;)
>
> I can see the context for them may be interesting, but in the grand scheme of
> things, I don't know if it's truly necessary. I mean, if this is something that
> people want, I can do it, but it doesn't seem to be high on the priority list.

no... don't do that, really... if someone wants to see the flow, they can do 
their own rules modifications...

what i ran into and the reason for my original posts, was that the bits were set 
but there was nothing to check them... no indication of a SO only rule or just a 
forgotten or commented out standard alert rule... that's why i ran my grep to 
find out if there was a rule disabled by default for those flowbits setters... 
if there was and it was disabled by default, then it might either need to be 
enabled by default or the flowbits setter rule should also be disabled by default...

as far as SO rules go, i don't know about other environments but ours does not 
use them by default... it requires specific and manual intervention to enable 
them as well as making them work (generating the stubs in the proper place and 
updating them when they change)... the fact that our environment it its own 
distribution and not one of the big name brand one adds complication to the 
process since they are distributed only in compiled form...

-- 
NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

------------------------------------------------------------------------------
Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET
Get 100% visibility into your production application - at no cost.
Code-level diagnostics for performance bottlenecks with <2% overhead
Download for free and get started troubleshooting in minutes.
http://p.sf.net/sfu/appdyn_d2d_ap1
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!