[Snort-sigs] sid 2586 False positive documentation

Message:  P2P eDonkey transfer
 
False positives:  This rule triggers when there is any traffic that has a 
source port of 4242 and the first hex byte is E3.  In our shop, this seems to 
happen regularly (once or twice a week) in SSL communication sessions 
(destination port 443) that just happen to have been dynamically assigned a 
source port of 4242.
 
I am not sure is this is characteristic of our network, or just the fact that 
any encrypted communication has an approximately 1/256 chance of beginning with 
the byte E3 (assuming encrypted traffic emulates a random distribution).  Of 
course, it only triggers the alert when the source port happens to be 4242 
(perhaps soon after the client reboots?).
 
Jim


This message and any included attachments are confidential, and are intended 
for the use of the addressee(s).  Unauthorized review, forwarding, printing, 
copying, distributing, or other such uses is strictly prohibited and may be 
unlawful.  If you received this message in error, or believe you are not 
authorized to receive it, please promptly delete this message and notify the 
sender of the error.



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_ide95&alloc_id396&opÌk
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs