[Snort-sigs] Comments for 3196

# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others.  References in the rules themselves
# should be used for linking to other's work. 
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
# 
# $Id$
#
# 

Rule:  
NetBIOS.rules
--
Sid:
3196
--
Summary:
CDROM server broadcast traffic falsely triggers NetBIOS rule.
--
Impact:
Unnecessary logging to snort/MySQL db
--
Detailed Information:
DiskZerver CDROM server continuously broadcasts to port 137 indicating a 
"NETBIOS name query overflow attempt UDP".
--
Affected Systems:
DiskZerver CDROM server, Linux version 2.0.27
--
Attack Scenarios:

--
Ease of Attack:

--
False Positives:
Continuous broadcasting on port 137
--
False Negatives:

--
Corrective Action:
For now, I commented out 3196 of NetBIOS.rules
--
Contributors:
Sean Hendrickson
-- 
Additional References:


*********************************
Sean Hendrickson 
IT Director 
Cross, Fernandez, and Riley, LLP. 
201 S. Orange Av 
STE 950 
Orlando, FL  32801-3421 
shendrickson@cfrcpa.com
Office: (407)841-6930 
Direct: (407)244-7170 
Cell  : (407)435-3038