Re: [Snort-sigs] typot false positives?

Yeah, i have seen a lot of this traffic, and i doubt its virii... we
should figure out how to fix this rule

-John


On Mon, 06 Sep 2004 13:40:46 +0200, Joerg Weber <j.weber@infos.de> wrote:
> Hello list,
>
> does anyone else experience apparently false positives with sid 2182?
>
> alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BACKDOOR typot trojan
> traffic"; flags:S,12; window:55808; flow:stateless;
> classtype:trojan-activity; reference:mcafee,100406; sid:2182; rev:7;)
>
> I have quite a few alarms but from all I can tell these are false
> positives (ie. traffic to non-existing hosts, as the rule is stateless
> this might not stop it from firing).
>
> Anyone else?
>
> Cheers,
>
> Joerg
>
> --
> Joerg Weber M. A.
> Network Security
>
> infoServe GmbH
> Nell-Breuning-Allee 6
> D-66115 Saarbruecken
>
> T: (0681) 8 80 08 - 59
> F: (0681) 8 80 08 - 33
> www.infos.de
> E: j.weber@infos.de



-- 
John Nagro
john.nagro@gmail.com


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs