Re: [Snort-sigs] False positive: zincite

I agree, I'm seeing them too. Especially in our environments with 
novell. They have a lot of connections with 524 as the service port 
(ncp), and 1034 as the source port. Yet the rule hits.

I don't really know what to do to it to make it actually only hit on 
packets with the real service port being 1034.

Any ideas out there? The rule has the things I'd try already.

Matt

twebster@daksoft.com wrote:

> I also receive numerous false positives with this rule. 
> tony
>
>
> snort-sigs-admin@lists.sourceforge.net wrote on 09/06/2004 07:32:42 AM:
>
>  
>
> > This rule is giving a lot of false positive:
> >
> > bleeding.rules:
> >
> > alert tcp $HOME_NET any -> any 1034 (msg:"BLEEDING-EDGE Worm Zincite 
> > Probing port 1034"; 
> > reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.
> > zindos.a.html; 
> > flow:to_server; sid:2001011; threshold: type threshold, track by_src, 
> > count 30,seconds 60; rev:3;)
> >
> > The option flow:to_server don't seems to give very good results.
> > Indeed, I have flows that have been initiated from a client using the 
> > port 1034 that are logged by this rule.
> >
> > Thierry
> >
> >    



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs