[Snort-sigs] FP on 2048 "MISC rsyncd overflow attempt"

I'm continually seeing this rule trigger on an rsync between two of our 
Linux boxes - both using rsync-2.6.4. Basically it's a rsnapshot backup 
script that runs every hour, and snort triggers - well - every hour... 
The "-z" option is being used - which means the data is gzip'ped - so 
it's continually changing, but it looks to me like there are a bunch of 
NULLs at the beginning the the session - which triggers the rule.

Example hex dump of a sample packet is attached


--
Cheers

Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1

 length = 1354

000 : 22 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00   "...............
010 : 00 00 00 00 24 03 00 00 00 00 00 00 00 00 00 00   ....$...........
020 : 00 00 00 00 00 00 00 00 26 03 00 00 00 00 00 00   ........&.......
030 : 00 00 00 00 00 00 00 00 00 00 00 00 28 03 00 00   ............(...
040 : 01 00 00 00 BC 02 00 00 02 00 00 00 30 01 00 00   ............0...
050 : 28 56 C7 EC 15 05 2A 03 00 00 02 00 00 00 BC 02   (V....*.........
060 : 00 00 02 00 00 00 36 01 00 00 A9 E9 A0 6A 04 64   ......6......j.d
070 : 4B 60 14 F4 71 9E 2C 03 00 00 01 00 00 00 BC 02   K`..q.,.........
080 : 00 00 02 00 00 00 D2 00 00 00 2D 3D 60 05 65 90   ..........-=`.e.
090 : 2E 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0a0 : 00 00 00 00 30 03 00 00 02 00 00 00 BC 02 00 00   ....0...........
0b0 : 02 00 00 00 AE 02 00 00 9A E1 69 7A 3F 7C 2B E0   ..........iz?|+.
0c0 : 9B D9 6D EC 32 03 00 00 02 00 00 00 BC 02 00 00   ..m.2...........
0d0 : 02 00 00 00 D8 00 00 00 95 CA D6 D8 1E E1 20 3D   .............. =
0e0 : 69 D7 68 25 34 03 00 00 01 00 00 00 BC 02 00 00   i.h%4...........
0f0 : 02 00 00 00 4C 02 00 00 8C B9 72 04 D4 EF 40 03   ....L.....r...@.
100 : 00 00 09 00 00 00 BC 02 00 00 02 00 00 00 BC 00   ................
110 : 00 00 02 E0 97 DC E6 B9 F6 FD 12 BD 89 96 9F FD   ................
120 : B3 B5 FE 95 58 EF 71 1A 8B 39 1C FF 03 40 8F CA   ....X.q..9...@..
130 : 5E ED EB 02 49 B9 2F FE A6 09 6F 5D 6D EC 37 97   ^...I./...o]m.7.
140 : 84 19 49 3C B9 38 33 F1 44 03 00 00 03 00 00 00   ..I<.83.D.......
150 : BC 02 00 00 02 00 00 00 AB 02 00 00 62 D1 ED 42   ............b..B
160 : BC 1A 0E D8 ED C6 AF E7 84 CC D2 AD A5 19 46 03   ..............F.
170 : 00 00 01 00 00 00 BC 02 00 00 02 00 00 00 87 00   ................
180 : 00 00 91 27 86 AF AE 39 4C 03 00 00 01 00 00 00   ...'...9L.......
190 : BC 02 00 00 02 00 00 00 8A 00 00 00 BB 28 AE 40   .............(.@
1a0 : 5B 16 4E 03 00 00 01 00 00 00 BC 02 00 00 02 00   [.N.............
1b0 : 00 00 C3 01 00 00 08 80 97 CD E4 35 50 03 00 00   ...........5P...
1c0 : 01 00 00 00 BC 02 00 00 02 00 00 00 7F 00 00 00   ...............
1d0 : 8F 23 88 24 CB 5B 9E 03 00 00 02 00 00 00 BC 02   .#.$.[..........
1e0 : 00 00 02 00 00 00 87 02 00 00 AF A1 01 6A EE EE   .............j..
1f0 : C6 91 FC 6A 10 88 B9 03 00 00 01 00 00 00 BC 02   ...j............
200 : 00 00 02 00 00 00 C6 00 00 00 C1 47 BB C2 3B 07   ...........G..;.
210 : BE 03 00 00 9C 02 00 00 BC 02 00 00 02 00 00 00   ................
220 : A5 02 00 00 AD 20 2D D5 45 41 0C 39 D1 D4 E8 60   ..... -.EA.9...`
230 : 61 FB 0D CF F7 5A E2 47 88 57 2F FA 83 1B F7 35   a....Z.G.W/....5
240 : D8 C1 BA 07 A1 16 A6 59 F7 23 87 98 22 6D 7A 48   .......Y.#.."mzH
250 : 44 CE 85 BB AB F9 B4 94 B2 AD 3F 1F 7C F8 61 C0   D.........?.|.a.
260 : 9E 39 08 F7 DE C3 50 34 0A 01 C2 97 99 FB 4C C4   .9....P4......L.
270 : B7 14 82 17 CD CF 15 E6 B4 06 CF 8D 64 CD D8 13   ............d...
280 : 91 0D 45 65 95 02 10 00 FD A3 BC 19 CC 76 C3 86   ..Ee.........v..
290 : 86 2F F1 32 01 A3 5C 0C 2C 6D AD B8 95 0F E8 EB   ./.2..\.,m......
2a0 : 2D 27 6C 4C 08 94 28 D0 1E 0C D6 99 51 18 36 FB   -'lL..(.....Q.6.
2b0 : 8E FA 15 60 E6 07 B0 68 BA EC 25 13 39 F9 FD 2A   ...`...h..%.9..*
2c0 : D9 EE 4A 79 9D EA 0D 38 57 1E CD E9 47 F9 00 4B   ..Jy...8W...G..K
2d0 : B5 F5 57 FE 8B 1B 26 21 C4 17 43 AC 33 95 0E F9   ..W...&!..C.3...
2e0 : 43 66 72 9C 3B 0E AF 80 34 CA AF 0A 7B 75 EE 19   Cfr.;...4...{u..
2f0 : FD 08 07 24 61 DF 12 14 96 E6 4A FE DB F6 07 42   ...$a.....J....B
300 : F7 08 23 02 85 B1 05 FB A4 12 25 0F 12 07 6D 05   ..#.......%...m.
310 : 53 91 6D 3C 5F 0E E9 5A AE 3D 0C 18 35 0A 89 76   S.m<_..Z.=..5..v
320 : 22 FC 26 A1 D9 19 12 11 AC 64 D5 0E 9B FB A9 C4   ".&......d......
330 : 86 A9 6A 0A C5 9A A1 33 D9 07 CB 88 26 B4 98 06   ..j....3....&...
340 : 14 76 BB 46 FD 05 96 61 44 77 ED 05 DA EB C9 82   .v.F...aDw......
350 : 41 12 7F 1C 89 67 D0 13 09 CA 16 C9 BD 15 F5 1D   A...g..........
360 : C0 5A 64 0B B2 AE C3 00 FA 0B E9 D9 A8 9A 82 FE   .Zd.............
370 : 7E F0 90 5C A3 0D 84 F0 B5 1C 88 FE 28 F1 65 62   ~..\........(.eb
380 : 87 07 6D 9E 56 28 CA 28 51 3E 76 60 98 03 4B F1   ..m.V(.(Q>v`..K.
390 : D1 CE 71 04 66 72 12 F9 F6 21 5A 60 D2 9B 2F 16   ..q.fr...!Z`../.
3a0 : 9D 81 16 EB 3B 1B 12 23 2C DB 5B 0C 6C 98 5E C3   ....;..#,.[.l.^.
3b0 : B4 0B 92 D3 77 91 56 13 9C C1 30 93 AB 0F 40 E3   ....w.V...0...@.
3c0 : 63 C0 CE 2E A0 47 7B C5 86 1C CC 3C BF 0C 21 25   c....G{....<..!%
3d0 : B2 B0 C1 7E 93 FC 98 09 18 F6 97 07 8A 4B 8B 62   ...~.........K.b
3e0 : 7F F5 02 CA 9A 3E F5 F5 E7 D0 CD BF 4C 02 C5 A8   ....>......L...
3f0 : 5A 54 DD F2 B1 8D AE F8 61 0D C5 5F A5 23 21 F5   ZT......a.._.#!.
400 : 61 B6 56 0E 08 09 2F DD A4 06 45 01 A1 62 CF 9C   a.V.../...E..b..
410 : C9 F1 EC D6 A6 CB F2 F8 6B AD BB ED 52 F9 1F CD   ........k...R...
420 : BB 2B 7B 0A DD 63 70 12 E9 01 94 E6 F3 7F 98 F3   .+{..cp........
430 : 3A 4B 37 ED 5E FF BB 25 55 36 19 06 56 58 B0 7A   :K7.^..%U6..VX.z
440 : 67 FE E9 25 9C 06 45 07 D3 FC A5 82 B2 03 6E AD   g..%..E.......n.
450 : 1C 2B 07 FE DE C3 62 CD 10 FE 67 C9 3E 58 5D FE   .+....b...g.>X].
460 : 02 B2 29 F8 E3 FD 27 17 5B B7 37 0A B3 16 1F BA   ..)...'.[.7.....
470 : 30 02 7F CC 4F 0D 0F FD 49 A6 86 89 AC FC 80 98   0..O...I.......
480 : B3 93 AE FD 8A D9 47 F3 8E 00 BB 9D B0 56 96 0B   ......G......V..
490 : C0 66 B3 52 46 0E 60 F5 EE 27 D1 09 2B 47 24 A6   .f.RF.`..'..+G$.
4a0 : 53 EC 96 A8 97 F8 F5 06 A1 EA 52 34 28 F7 27 92   S.........R4(.'.
4b0 : BE 0C 46 05 A6 DA 38 B3 8B ED 8B 8C 2F DA D2 EE   ..F...8...../...
4c0 : 0A F9 1F A0 73 F0 AF 7C DE 5A 3A 08 FD C3 1C 20   ....s..|.Z:.... 
4d0 : D9 F9 8B 19 43 27 27 F4 B9 08 2B 91 C6 FA A1 5C   ....C''...+....\
4e0 : E0 22 0C 16 20 88 6C 45 28 0F AD EA 00 A9 7E 0A   .".. .lE(.....~.
4f0 : 11 63 D4 2E 2A 0F 34 14 78 BA D2 09 FA 5C 87 55   .c..*.4.x....\.U
500 : 01 14 B8 C7 90 72 49 00 0E 0E 88 31 AC 30 A4 40   .....rI....1.0.@
510 : 04 A4 A1 11 DF 88 FA AD 9B 16 2A F0 87 6D A2 09   ..........*..m..
520 : 94 16 49 44 61 FE 31 96 70 E5 85 0A F3 3F 92 B7   ..IDa.1.p....?..
530 : DF FA E5 A2 9B 5C 69 F5 D9 60 06 55 8E F4 06 7B   .....\i..`.U...{
540 : 35 9A 2F 11 E3 ED 40 B0 CE 0B                     5./...@...