I also get a few alerts for sid 2182, I dismissed them as the targets are
not linux. However, are people with false positives noticing similar
source/dest ports among alerts? Unless there is some correlation between
tcp windowsize and port numbers, I hesitate to call mine false-positive.
-peter
rule:
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BACKDOOR typot trojan
traffic"; flags:S,12; window:55808; flow:stateless;
classtype:trojan-activity; reference:mcafee,100406; sid:2182; rev:7;)
----- Original Message -----
From: "John Nagro" <john.nagro@gmail.com>
To: "Joerg Weber" <j.weber@infos.de>
Cc: <snort-sigs@lists.sourceforge.net>
Sent: Thursday, September 09, 2004 8:31 AM
Subject: Re: [Snort-sigs] typot false positives?
Yeah, i have seen a lot of this traffic, and i doubt its virii... we
should figure out how to fix this rule
-John
On Mon, 06 Sep 2004 13:40:46 +0200, Joerg Weber <j.weber@infos.de> wrote:
Hello list,
does anyone else experience apparently false positives with sid 2182?
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BACKDOOR typot trojan
traffic"; flags:S,12; window:55808; flow:stateless;
classtype:trojan-activity; reference:mcafee,100406; sid:2182; rev:7;)
I have quite a few alarms but from all I can tell these are false
positives (ie. traffic to non-existing hosts, as the rule is stateless
this might not stop it from firing).
Anyone else?
Cheers,
Joerg
--
Joerg Weber M. A.
Network Security
infoServe GmbH
Nell-Breuning-Allee 6
D-66115 Saarbruecken
T: (0681) 8 80 08 - 59
F: (0681) 8 80 08 - 33
www.infos.de
E: j.weber@infos.de
--
John Nagro
john.nagro@gmail.com
-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 13. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
