Hmmm... no doc file or references for this rule so I don't know what it is
trying to detect. The content trigger is *very* short (2 chars) at start of
packet and it looks at all traffic except port 139.
Anyway it is generating many thousands of alerts an hour on our network. Some
TCP sessions are alerting several times a second.
I'm about to disable the rule.
This should give folk some idea of the size of the problem on our network
Time Window for this screen: Tue Sep 27 15:42:52 2005 to Tue Sep 27 16:02:06
2005
Signature Total Events IP Srcs IP Dsts Latest Timestamp
COMMUNITY MISC BAD-SSL tcp detect 8043 250 49 2005-09-27
16:02:06
Russell
META
--------
SID CID TimeStamp Signature
1 123879 2005-09-27 15:39:24 COMMUNITY MISC BAD-SSL tcp detect
Sig ID
100000137
Sensor Hostname Sensor Interface
monitor-itss.insec.auckland.ac.nz ITSS sector switch
IP
--------
Source Address Dest Address Ver Hdr Len
130.216.48.6 130.216.196.105 4 5
TOS length ID flags offset TTL chksum
0 156 22632 2 0 62 59859
Resolved Source
jones.math.auckland.ac.nz
Resolved Dest
xt5.scitec.auckland.ac.nz
TCP
--------
Source Port Dest Port Seq Ack
58108 6002 3940890034 347283752
Offset Reserved Flags Window Checksum Urgent Ptr
8 0 24 2896 44570 0
Options
--------
None
Flags
--------
RB 1 RB 0 URG ACK PSH RST SYN FIN
X X
DATA
--------
12000E0012002001FF00 ...... ...
00000400000020000500 ...... ...
08000000A00100007F01 ..........
000081010000E8000000 ..........
E7000000280100001F00 ....(.....
0000D601000019000B00 ..........
12002001000000001FA3 .. .......
4F400000000012002001 O@...... .
010000007F010000FF00 ..........
000000000000201F1040 ...... ..@
2B000100 +...
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
