Dear Snort Developers,
I found a false positive caused by a Snort rule, and wanted to submit an
update for that rule. Using the template provided by the website, I am
submitting updated information for only those sections of the documentation
that are pertinent. The rest of the rule documentation is ok as it is. :)
Let me know if you need more info, or have other questions. Thanks for your
attention in this matter.
Doug McLean
# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others. References in the rules themselves
# should be used for linking to other's work.
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
#
# $Id$
#
#
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN FIN";
flow:stateless; flags:F,12; reference:arachnids,27;
classtype:attempted-recon; sid:621; rev:7;)
--
Sid: 1:621
--
Summary:
--
Impact:
--
Detailed Information:
--
Affected Systems:
--
Attack Scenarios:
--
Ease of Attack:
--
False Positives: Peer to Peer file sharing programs, such as Gnutella have
been known to trigger this rule in Snort. To verify if this is a false
positive, check to see if the scans are only directed toward a single port,
and that port is traditionally used for file sharing purposes.
--
False Negatives:
--
Corrective Action:
--
Contributors:
--
Additional References:
Doug McLean
CSS Systems Administrator
University of Washington, Bothell
http://staff.washington.edu/dougmc/pgp.html
-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
