Ok, I took a look at the packet and this is what I found. First,
while the offset is 5 and that is where Snort started looking, the
depth to look was 15. The |04 00| sequence was found at 5 (offset) +
13/14. The |04 00| combination was actually found in the Request ID
field of the packet as apposed to the Community string.
With that said and after reading a little of the snmp_api.h code from
ucd-snmp, I wonder if you could do set this sig to a depth of 2. It
appears that the 5 + 2 byte is the length of the community string,
allowing for a community string of 0 - 255 characters. The first
digit (5 + 1), I didn't find a reference to. I also am not sure that
changing the depth to 2 would make this effective for SNMPv3 packets,
however I couldn't find where everything is supposed to be in an
SNMPv3 packet.
Anyhow, that's my two cents. :)
Mark
On Fri, 15 Oct 2004 13:56:07 -0400, Matt Kettler <mkettler@evi-inc.com> wrote:
At 04:01 AM 10/14/2004, Koelewijn, Bert wrote:
Dear snort sigs team,
SID:1893 SNMP missing community string attempt
This rule has a false positive with the attached packet. The rule triggers
on the SNMP request id.
Hmm, that's quite odd. The rule should avoid hitting that packet with the
depth and offset keywords.
What snort version are you using? 2.2.0?
What rev of 1893 are you using? (although as far as I can tell, even rev 1
has the depth/offset, and rev4 is the latest, it's helpful to know for sure
what rule you're using).
Please keep the information in the attachment confidential.
That will be difficult.. This is a public mailing list.
However, for what it's worth, I'll avoid disclosing any of the information
in the packet.
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
--
Mark Buchanan
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
