Gould, Scott wrote:
Alex,
Thank you for the quick response. I should have been a little more
specific. The 2 content matches will usually be separated by a
non-standard number of other information. So the distance between the 2
will not always be the same.
This is not a problem when using the distance modifier by itself.
Distance only stipulates that the search starts from that point relative
to the current match. Distance 0 says start looking at the end of the
last match and continue until the end of the packet. If you want a limit
on how far to go you can add within after the distance.
content:"A"; content:"B"; distance:0
will catch
ssdfvsdfAsdfghsdkfghlksjdfgkjfg sfdkjghskldfhgksjfdg Bsdfasdf
or
ssdfvsdfAsdfghsBkfghlksjdfgkjfg sfdkjghskldfhgksjfdg asdfasdf
or
Asdfvsdfssdfghsdkfghlksjdfgkjfg sfdkjghskldfhgksjfdg ssdfasdB
and not
ssdfvsdfBsdfghsdkfghlksjdfgkjfg sfdkjghskldfhgksjfdg Asdfasdf
For example (still using A and B as the 2 separate content requirements
in the example below (all other characters are for example purposes only
and represent any info in potential payload))
ssdfvsdfAsdfghsdkfghlksjdfgkjfg sfdkjghskldfhgksjfdg Bsdfasdf
Yet the rule is currently get triggered if either
ssdfvsdfAsdfghsdkfghlksjdfgkjfg sfdkjghskldfhgksjfdg Bsdfasdf
Or
ssdfvsdfBsdfghsdkfghlksjdfgkjfg sfdkjghskldfhgksjfdg Asdfasdf
Is seen and I would like it to only catch
ssdfvsdfAsdfghsdkfghlksjdfgkjfg sfdkjghskldfhgksjfdg Bsdfasdf
Make sense?
Sorry for not be specific enough in my first example. It must have been
too late for me to be up, lol.
Any ideas?
Scott Gould, MCP
Senior Network & Systems Analyst
Gynecologic Oncology Group
Statistical & Data Center
sgould@gogstats.org
716-845-5702
-----Original Message-----
From: Alex Kirk [mailto:alex.kirk@sourcefire.com]
Sent: Thursday, November 18, 2004 8:54 AM
To: Gould, Scott
Cc: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] Multiple content requirements in single rule,
force order requirement
Scott,
If you use distance:0 as a modifier to your second content, you'll get
the desired effect here.
Example:
content:"A"; content:"B"; distance:0;
This works because specifying a distance implies that you're looking for
some criterion that comes after another one; the value of zero lets you
start immediately after your first match.
Alex Kirk
Research Analyst
Sourcefire, Inc.
I have a rule that has 2 different content requirements. I would like
to be able to have the rule require that one of the content matches
must be before the other, in order for the rule to be triggered.
Overly simplified example:
content: "A"; content: "B";
I want the rule to only match on AB not on BA.
Make sense? I can't seem to find anything in the snort rule docs under
the content section.
Any advice?
Thanks in advance,
Scott
-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE FREE OODBMS
DOWNLOAD - A multidimensional database that combines robust object and
relational technologies, making it a perfect match for Java, C++,COM,
XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
