Lance,
As has been said by all the Bleeding folks, not bad for a first rule.
I've got one more thing you'll want to contemplate, though (and would
have added it earlier in the discussion, but this whole exchange took
place *after* I'd left for the airport on Friday afternoon). Does Netop
use TCP, and thus establish a connection (Syn, Syn/Ack, Ack) before
sending this data? If so, you'll want to add the flow keyword to our
rule, either as flow:established or flow:(to|from)_server,established
(depending there on which direction the packets would be headed). The
concept here is simple: by adding the flow keyword, you can let Snort
only pay attention to the subset of packets that have met the required
TCP connection criteria, dramatically speeding performance in the
process. Honestly, it's such a key part of good rule-writing to consider
flow that it's become automatic for me to type flow: after my rule's msg
-- on the rare occasion it's not relevant, I just laugh at myself and
delete it before continuing.
Also, you may want to consider not using any any -> any any, but instead
$HOME_NET any -> any any, for much the same reason you'd want to add
flow. After all, if you know that all of the traffic you care about will
be originating on your $HOME_NET, why bog Snort down by looking at all
the gunk coming in from the Internet at large? Alternately, if you know
that everything will start from $HOME_NET + your "remote subnets", you
might consider creating a variable which encompasses all of those IPs
(which is probably a good variable to have anyway) and using it instead
of $HOME_NET here.
I hope that's helpful information...and feel free to ask if I've
confused you or you need clarification. :-)
Alex Kirk
Research Analyst
Sourcefire, Inc.
Thanks for pointing that out here's the updated rule
alert udp any any -> any any (msg:"Netop Remote Control Usage";
content:"|554b30303736305337473130|"; reference:url,www.netop.com;
classtype:policy-violation; sid:2000000; rev:2;)
This caught my traffic going to my remote subnets. I tried increasing
the revision # as well but to no avail so I changed the sid to 2000001
alert udp any any -> any any (msg:"Netop Remote Control Usage";
content:"|554b30303736305337473130|"; reference:url,www.netop.com;
classtype:policy-violation; sid:2000001; rev:1;)
Now it's showing up in Acid correctly
-----Original Message-----
From: Matt Jonkman [mailto:matt@infotex.com]
Sent: Friday, December 17, 2004 2:10 PM
To: Lance Boon
Cc: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] First attempt at writing a sig
Not a bad run for a first sig. Thanks for posting it.
Why did you go home-home net? Why not home-any? Or even any-any? I'm not
that familiar with the tool, but I'd think the most interesting traffic
would be someone from the outside connecting to a local box.
As far as why it doesn't show right in acid, not sure. It is crafted
correctly. Try increasing the rev number and hitting it again. I wonder
if maybe the first time you had a hit the msg was empty, in which case
it won't take the new msg until the rev # increases.
I'll put this up on bleeding snort for more testing after we sort out
the reasons for the home-home.
Matt
Lance Boon wrote:
This is my first attempt at writing a sig and wondered if anybody had
any pointers. I got a pcap of a netop session to 2 different systems,
ran it through snort and noticed that the content was the same on in
one
particular packet. So I wrote a rule for it, I have this working on my
network right now and haven't had any false positives yet. The only
thing that is bugging me and I'm sure that it's something that I'm
missing is that when an alert hits it doesn't read "Netop Remote
Control
Usage" on the acid page it just says [snort] Snort Alert [1:2000000:0]
alert udp $HOME_NET any -> $HOME_NET any (msg:"Netop Remote Control
Usage"; content:"|554b30303736305337473130|";
reference:url,www.netop.com; classtype:policy-violation; sid:2000000;
rev:1)
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
