[Snort-sigs] Re: snort-rules update @ Thu Nov 11 15:27:17 2004

On Thu, Nov 11, 2004 at 03:27:17PM -0500, bmc@snort.org wrote:
> <snip a large list of netbios rules>

As you can see, this rulepack includes a large number of netbios
rules.  If you see any false positives on these rules, PLEASE let me
know as soon as possible.

These rules are now code generated.  If you let me know of false
positives in one rule, it will allow me to fix a large number of other
rules.

> 2950 - NETBIOS SMB too many stacked requests (netbios.rules, requires 2.1 or 
> later)
> 2951 - NETBIOS SMB-DS too many stacked requests (netbios.rules, requires 2.1 
> or later)

These two rules are a direct result of information provided by ya'll
thanks to running the rules I provided on snort-sigs & snort-users on
Nov 1st.  Based on what I've seen, these rules should never go off.
IF they are going off, I'm willing to bet it is an IDS evasion
attempt.  PLEASE send me pcap if these rules ever go off.  

So, in addition to thanking Sourcefire for paying us to write these
rules, make sure to thank yourself if you sent me email based on my
research rules.

Brian


-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs