<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><p class="MsoNormal">Dear Open Information Security Foundation team,<o:p></o:p></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">My name is Alex and I'm doing a masters project that
requires me to install an open source intrusion detection system (Suricata,
Snort etc.) on a Linux system that is running a Modbus TCP simulator (Conpot). <o:p></o:p></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">I have obtained the 14 Modbus TCP rules (Digital Bond) that had
been written for Snort. I decided to use these rules with Suricata. I know that
these rules are fully compatible with Suricata. However, I am unable to execute
the following rule:<o:p></o:p></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">alert tcp $MODBUS_CLIENT any <> $MODBUS_SERVER 502
(flow:established; pcre:"/[\S\s]{2}(?!\x00\x00)/iAR";
msg:"SCADA_IDS: Modbus TCP - Non-Modbus Communication on TCP Port
502"; reference:url,digitalbond.com/tools/quickdraw/modbus-tcp-rules;
classtype:non-standard-protocol; sid:1111009; rev:1; priority:1;)<o:p></o:p></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">I get the following error message:<o:p></o:p></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">1/7/2014 -- 23:32:47 - <Error> - [ERRCODE:
SC_ERR_INVALID_SIGNATURE(39)] - pcre with /R (relative) needs preceeding match
in the same buffer<o:p></o:p></p>
<p class="MsoNormal">1/7/2014 -- 23:32:47 - <Error> - [ERRCODE:
SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp
$MODBUS_CLIENT any <> $MODBUS_SERVER 502 (flow:established;
pcre:"/[\S\s]{2}(?!\x00\x00)/iAR"; msg:"SCADA_IDS: Modbus TCP -
Non-Modbus Communication on TCP Port 502";
reference:url,digitalbond.com/tools/quickdraw/modbus-tcp-rules;
classtype:non-standard-protocol; sid:1111009; rev:1; priority:1;)" from
file /etc/suricata/rules/modbus.rules at line 14<o:p></o:p></p>
<p class="MsoNormal"><br></p><p class="MsoNormal">I tried adding “^” to the following line:<o:p></o:p></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">pcre:"/^[\S\s]{2}(?!\x00\x00)/iAR"<o:p></o:p></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">However, that didn't solve the problem. I am using Suricata
2.0.2. The operating system is Linux Ubuntu 12.04.<o:p></o:p></p><p class="MsoNormal"><br></p><p class="MsoNormal">The rule:</p><p class="MsoNormal"><a href="http://www.digitalbond.com/tools/quickdraw/modbus-tcp-rules/rule-1111009/" target="_blank" style="font-size: 12pt;">http://www.digitalbond.com/tools/quickdraw/modbus-tcp-rules/rule-1111009/</a></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">I have very limited knowledge of Linux and IDSs in general,
but I would really like to get this rule to work.<o:p></o:p></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">Looking forward to your reply.<o:p></o:p></p><p class="MsoNormal"><br></p>
<p class="MsoNormal">Regards,<o:p></o:p></p>
<p class="MsoNormal">Alex<o:p></o:p></p> </div></body>
</html>