[Oisf-users] Should this be firing?

[Will Metcalf]

Based on the signature... ya... perhaps
flowbits:isnotset,is_proto_irc; should be
flowbits:isset,is_proto_irc;, also I'm not sure what offset:0; is
doing in there, it adds nothing to the rule.

Regards,

Will

On Wed, Jul 13, 2011 at 10:37 AM, Paul Halliday <paul.halliday at gmail.com> wrote:
> SID 2002027: ET CHAT IRC PING
> alert tcp any any -> any any (msg:"ET CHAT IRC PING command";
> flowbits:isnotset,is_proto_irc; flow: from_server,established;
> content:"PING|20|"; nocase; offset: 0; flowbits: set,irc.ping;
> flowbits:noalert;
>
>
> On:
>
> ping basket">...........</a>.....................................</td>........<td>....
> ......................
> ... ......................................
>
> Or:
>
> ping in an Underwater Bedroom Would Be Amazing</a></h1>.......<div
> class="post-body">........<p>.........The Conrad Mald
> ives Rangali Island Hotel in the Indian Ocean has a stunning undersea
> restaurant. To celebrate its 5th anniversary, the
> hotel turned the restaurant into a private bedroom for two with a
> fancy champagne dinner and breakfast in bed..........<
> a href="http://gizmodo.com/5820721/sleeping-in-an-underwater-bedroom-would-be-amazing"
>
> I have a few rules today that seem to be acting a little strange. A
> setting maybe?
>
> [100153] 13/7/2011 -- 12:37:35 - (suricata.c:431) <Info> (main) --
> This is Suricata version 1.0.4
>
>
> Thanks.
>
> --
> Paul Halliday
> http://www.squertproject.org/
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>