<div>Hi,</div>
<div>What are the values for EXT and HOME nets in your yaml configuration (you can mail me privately if you would like) ?</div>
<div> </div>
<div>Thanks<br><br></div>
<div class="gmail_quote">On Tue, Jan 24, 2012 at 10:10 PM, rmkml <span dir="ltr"><<a href="mailto:rmkml@yahoo.fr">rmkml@yahoo.fr</a>></span> wrote:<br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">Hi Peter,<br>You are right, I have missed these rules: (partial/special emerging threats with my pcap example)<br>
<br>alert udp $EXTERNAL_NET any -> $HOME_NET 123 (msg:"GPL EXPLOIT ntpdx overflow attempt"; dsize:>128; classtype:attempted-admin; reference:bugtraq,2540; reference:cve,2001-0414; sid:2100312; rev:7;)<br>alert udp $EXTERNAL_NET any -> $HOME_NET 162 (msg:"GPL SNMP SNMP trap Format String detected"; content:"%s"; classtype:attempted-recon; reference:bugtraq,16267; reference:cve,2006-0250; reference:url,<a href="http://www.osvdb.org/displayvuln.php?osvdb_id=22493" target="_blank">www.osvdb.org/<u></u>displayvuln.php?osvdb_id=22493</a><u></u>; sid:100000227; rev:2;)<br>
alert udp $EXTERNAL_NET any -> $HOME_NET 27777 (msg:"GPL GAMES Amp II 3D Game Server Denial of Service Empty UDP Packet"; dsize:0; classtype:attempted-dos; reference:bugtraq,12192; sid:100000104; rev:2;)<br>alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"GPL EXPLOIT EXPLOIT SIP UDP spoof attempt"; content:"|3B|branch|3D 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 0A|"; nocase; classtype:attempted-dos; reference:bugtraq,14174; reference:cve,2005-2182; reference:url,<a href="http://www.osvdb.org/displayvuln.php?osvdb_id=17838" target="_blank">www.osvdb.org/<u></u>displayvuln.php?osvdb_id=17838</a><u></u>; sid:100000180; rev:1;)<br>
alert udp $EXTERNAL_NET any -> $HOME_NET 7649 (msg:"GPL GAMES Breed Game Server Denial of Service Empty UDP Packet"; dsize:0; classtype:attempted-dos; reference:bugtraq,12262; sid:100000103; rev:2;)<br><br>can you retest with all rules please?<br>
Regards<span class="HOEnZb"><font color="#888888"><br>Rmkml</font></span>
<div class="HOEnZb">
<div class="h5"><br><br><br><br>On Tue, 24 Jan 2012, Peter Manev wrote:<br><br>
<blockquote style="BORDER-LEFT:#ccc 1px solid;MARGIN:0px 0px 0px 0.8ex;PADDING-LEFT:1ex" class="gmail_quote">Hi,<br>Suricata 1.2.1 behaves as expected - there is no alerts fired.<br>If you would like, you can share your yaml privately for further investigation.<br>
<br>Thanks for your help<br><br>On Tue, Jan 24, 2012 at 12:45 AM, rmkml <<a href="mailto:rmkml@yahoo.fr" target="_blank">rmkml@yahoo.fr</a>> wrote:<br> Hi,<br> Im curious with this joigned pcap file on suricata v1.2.1, FP signatures example:<br>
alert udp any any -> any 162 (msg:"suricata snmp trap udp"; dsize:0; classtype:attempted-recon; sid:9104192; rev:1;)<br> another FP signature with same pcap:<br> alert udp any any -> any 5060 (msg:"suricata sip udp "; dsize:0; classtype:misc-attack; sid:9104843; rev:1; )<br>
...<br> Anyone check/confirm please? if yes Im open a new redmine ticket.<br> No alert with snort.<br><br> Tshark partial output:<br> ...<br> Internet Protocol Version 4, Src: 172.20.2.131 (172.20.2.131), Dst: 172.20.2.51 (172.20.2.51)<br>
Version: 4<br> Header length: 20 bytes<br> Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))<br> Total Length: 1500<br> Identification: 0x7709 (30473)<br>
Flags: 0x01 (More Fragments)<br> 0... .... = Reserved bit: Not set<br> .0.. .... = Don't fragment: Not set<br> ..1. .... = More fragments: Set<br> Fragment offset: 0<br> Time to live: 128<br>
Protocol: UDP (17)<br> Header checksum: 0x4129 [correct]<br> Source: 172.20.2.131 (172.20.2.131)<br> Destination: 172.20.2.51 (172.20.2.51)<br> Data (1480 bytes)<br> ...<br><br> Happy Detect.<br>
Regards<br> Rmkml<br><br> <a href="http://twitter.com/rmkml" target="_blank">http://twitter.com/rmkml</a><br> ______________________________<u></u>_________________<br> Oisf-devel mailing list<br> <a href="mailto:Oisf-devel@openinfosecfoundation.org" target="_blank">Oisf-devel@<u></u>openinfosecfoundation.org</a><br>
<a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel" target="_blank">http://lists.<u></u>openinfosecfoundation.org/<u></u>mailman/listinfo/oisf-devel</a><br><br><br><br><br>--<br>Peter Manev<br>
<br></blockquote></div></div></blockquote></div><br><br clear="all"><br>-- <br>Peter Manev<br>