[Oisf-users] Suricata - test rule ignored/not dropping.
Anas.B
a.bouhsaina at gmail.com
Tue Jul 27 08:54:14 UTC 2010
Good morning,
This is my case :
Bridging is successful since I have net connection in my host
---Net-Router(172.20.81.1)-----<- Bridge (suricata in computer (with 2
cards) ->------ my host (172.20.81.101)
br0 eth1 eth0
*But* when i tried this rule :
drop tcp 172.20.81.101 any -> any any (content:"facebook"; msg:"Attention,
Facebook !!!"; sid:1000002; rev:1;)
or :
drop tcp any any -> any any (content:"facebook"; msg:"Attention, Facebook
!!!"; sid:1000002; rev:1;)
I just have an alert, but I can enter to facebook.........!!!
07/26/10-08:28:07.517395 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1740 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:08.206148 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1742 ->
72.14.235.100:80 <http://72.14.235.100/>
07/26/10-08:28:08.380125 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1740 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:09.079290 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1741 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:28:09.544135 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1745 ->
87.248.218.92:80 <http://87.248.218.92/>
07/26/10-08:28:09.639904 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1746 ->
68.87.64.116:80 <http://68.87.64.116/>
07/26/10-08:28:09.653826 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1744 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:28:09.830274 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1748 ->
4.71.209.15:80 <http://4.71.209.15/>
07/26/10-08:28:10.008049 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1747 ->
209.85.227.100:80 <http://209.85.227.100/>
07/26/10-08:28:10.300653 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1749 ->
68.87.78.149:80 <http://68.87.78.149/>
07/26/10-08:28:11.977590 [**] [1:485:5] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {1} 172.20.80.1:3 -> 172.20.80.100:13
07/26/10-08:28:17.931527 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1740 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:21.189125 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1750 ->
66.220.146.11:80 <http://66.220.146.11/>
07/26/10-08:28:38.168496 [**] [1:485:5] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {1} 172.20.80.1:3 -> 172.20.80.100:13
07/26/10-08:28:42.299672 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1770 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:44.941011 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1804 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:47.559393 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1839 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:49.628545 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1848 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:51.678339 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1862 ->
66.220.146.11:80 <http://66.220.146.11/>
07/26/10-08:28:52.378889 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1799 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:28:54.486073 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1875 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:28:56.420210 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1889 ->
87.98.130.52:80 <http://87.98.130.52/>
07/26/10-08:29:04.413680 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1926 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:29:08.820362 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1946 ->
72.14.235.100:80 <http://72.14.235.100/>
07/26/10-08:29:09.216669 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1949 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:29:12.252341 [**] [1:485:5] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {1} 172.20.80.1:3 -> 172.20.80.100:13
07/26/10-08:29:13.124177 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1964 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:29:13.709394 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1967 ->
66.220.146.11:80 <http://66.220.146.11/>
07/26/10-08:29:13.997069 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1974 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:14.158277 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1976 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:14.191434 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1976 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:14.206014 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1976 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:15.576897 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1974 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:21.263951 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:1997 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:29:24.106282 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2027 ->
66.220.146.11:80 <http://66.220.146.11/>
07/26/10-08:29:43.536743 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:44.225171 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:44.269318 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:44.582251 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:46.024928 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2049 ->
80.157.170.80:80 <http://80.157.170.80/>
07/26/10-08:29:46.158738 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2048 ->
196.12.213.56:80 <http://196.12.213.56/>
07/26/10-08:29:46.778466 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2050 ->
80.157.170.73:80 <http://80.157.170.73/>
07/26/10-08:29:46.850379 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2050 ->
80.157.170.73:80 <http://80.157.170.73/>
07/26/10-08:29:47.447351 [**] [1:485:5] ICMP Destination Unreachable
Communication Administratively Prohibited [**] [Classification: Misc
activity] [Priority: 3] {1} 172.20.80.1:3 -> 172.20.80.100:13
07/26/10-08:29:50.837632 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2054 ->
196.12.213.57:80 <http://196.12.213.57/>
07/26/10-08:29:51.511817 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:51.578581 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:51.649844 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:51.973257 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:52.343481 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:53.313476 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:54.678733 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:55.056374 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:55.398719 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:55.733208 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:57.166266 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:57.293175 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:57.812568 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2058 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:58.522060 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:58.589148 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:58.657140 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:29:59.509121 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.129142 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.194528 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.555942 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.646232 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2057 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:00.874448 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2058 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:01.396735 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:01.491180 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:01.560120 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:01.939659 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:02.238916 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:02.838980 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:04.038863 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:04.822896 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2075 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:30:05.234740 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:05.995330 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2078 ->
72.14.235.104:80 <http://72.14.235.104/>
07/26/10-08:30:06.429322 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2080 ->
208.80.152.2:80 <http://208.80.152.2/>
07/26/10-08:30:06.438720 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:08.541125 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2077 ->
67.18.23.65:80 <http://67.18.23.65/>
07/26/10-08:30:13.636323 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2061 ->
93.186.135.89:80 <http://93.186.135.89/>
07/26/10-08:30:13.892064 [**] [1:1000002:1] Attention, Facebook !!! [**]
[Classification: (null)] [Priority: 3] {6} 172.20.80.100:2095 ->
67.18.23.65:80 <http://67.18.23.65/>
Packets are not dropped ! can someone explain to me why ?
this is the iptables configurtion of the bridge
iptables -A INPUT -j NFQUEUE
iptables -A FORWARD -j NFQUEUE
iptables -A OUTPUT -j NFQUEUE
Thank you,
Cheers.
A..
2010/7/27 Victor Julien <victor at inliniac.net>
> The dropping appears to work if a 'content:"/";' is added like this:
>
> drop tcp any any -> any 80 (msg:"Snort_Inline is blocking the http
> link"; sid:1; content:"/";)
>
> It should work without it as well though, so opened a bug ticket for it:
>
> https://redmine.openinfosecfoundation.org/issues/221
>
> Thanks for the report Morgan!
>
> Cheers,
> Victor
>
> Morgan Cox wrote:
> > Hi.
> >
> > I am quite familiar with running snort in inline mode.
> >
> > I have setup bridging mode on Ubuntu Lucid = eth0+eth1 = br0
> >
> > , I have added emerging and VRS rules.
> >
> > It is running ok - but ignoring my test (drop) rule
> >
> > I want suricata to examine all traffic (including to the Suricata server)
> >
> > I have used a startup script:-
> >
> > /sbin/iptables -A INPUT -j NFQUEUE --queue-num 0
> > /sbin/iptables -A FORWARD -j NFQUEUE --queue-num 0
> > /sbin/iptables -A OUTPUT -j NFQUEUE --queue-num 0
> > sleep 1
> > /usr/local/bin/suricata -c /etc/suricata/suricata.yaml -q 0 -D
> > --pidfile=/var/run/suricata.pid
> >
> > For my test rule I just want it to drop all attempts to go to port 80
> > (for the Bridge + the Suricata server)
> >
> > Previously I have used
> >
> >
> > drop tcp any any -> any 80 (classtype:attempted-user; msg:"Port 80
> > connection initiated";)
> >
> > But it errors:-
> >
> > [1296] 26/7/2010 -- 14:53:01 - (detect.c:301) <Error>
> > (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Error
> > parsing signature "drop tcp any any -> any 80 (msg:"Snort_Inline is
> > blocking the http link";) " from file
> > /etc/suricata/rules/emerging-malware.rules at line 1314
> >
> > - somehow the syntax isn't working.
> >
> >
> >
> > If I use:-
> >
> > drop tcp any any -> any 80 (classtype:attempted-user; msg:"Port 80
> > connection initiated";)
> >
> > I get no errors (in the log) but can still access port 80 on the
> > Suricate server - i.e :-
> >
> > http://ipaddressofsuricataserver.com:80
> >
> > And I get nothing in the logs, no alert + no drop - so my test rule
> > isn't working.
> >
> >
> > Lastly I have tried (from the blog)
> >
> > drop tcp any any -> any 80 (msg:"testing drop"; content:"*";
> > http_header; sid:123321;)
> >
> > This does trigger an 'alert' when I go to
> >
> > http://ipaddressofsuricataserver.com:80
> >
> > in fast.log :-
> >
> > 07/26/10-14:01:54.377706 [**] [1:123321:0] testing drop [**]
> > [Classification: (null)] [Priority: 3] {6} (clientIP):49769 ->
> (serverip):80
> >
> > The issue is is that it is NOT blocking - I can still access it.
> >
> > Can anyone suggest how to make it drop correctly ?
> >
> > Cheers
> >
> >
> >
> >
> >
> >
> >
> >
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > Oisf-users mailing list
> > Oisf-users at openinfosecfoundation.org
> > http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20100727/e03eb395/attachment-0002.html>
More information about the Oisf-users
mailing list