ok,
this rule is generic and detect netbios/139, ssl/443....
but for me, detect openvpn tcp TUNNELING ... (drop event on
regular ports 139,443,3389,...)
regards
Rmkml
On Tue, 27 Sep 2005, Rich Adamson wrote:
Date: Tue, 27 Sep 2005 05:36:25 -0600
From: Rich Adamson <radamson@routers.com>
To: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] False +VES COMMUNITY MISC BAD-SSL tcp detect,Sig ID,
100000137
same here... lots of FP's.
------------------------
Hmmm... no doc file or references for this rule so I don't know what it is trying to detect.
The content trigger is *very* short (2 chars) at start of packet and it looks
at all traffic
except port 139.
Anyway it is generating many thousands of alerts an hour on our network. Some TCP sessions are
alerting several times a second.
I'm about to disable the rule.
This should give folk some idea of the size of the problem on our network
Time Window for this screen: Tue Sep 27 15:42:52 2005 to Tue Sep 27 16:02:06
2005
Signature Total Events IP Srcs IP Dsts Latest Timestamp
COMMUNITY MISC BAD-SSL tcp detect 8043 250 49 2005-09-27
16:02:06
Russell
META
--------
SID CID TimeStamp Signature
1 123879 2005-09-27 15:39:24 COMMUNITY MISC BAD-SSL tcp detect
Sig ID
100000137
Sensor Hostname Sensor Interface
monitor-itss.insec.auckland.ac.nz ITSS sector switch
IP
--------
Source Address Dest Address Ver Hdr Len
130.216.48.6 130.216.196.105 4 5
TOS length ID flags offset TTL chksum
0 156 22632 2 0 62 59859
Resolved Source
jones.math.auckland.ac.nz
Resolved Dest
xt5.scitec.auckland.ac.nz
TCP
--------
Source Port Dest Port Seq Ack
58108 6002 3940890034 347283752
Offset Reserved Flags Window Checksum Urgent Ptr
8 0 24 2896 44570 0
Options
--------
None
Flags
--------
RB 1 RB 0 URG ACK PSH RST SYN FIN
X X
DATA
--------
12000E0012002001FF00 ...... ...
00000400000020000500 ...... ...
08000000A00100007F01 ..........
000081010000E8000000 ..........
E7000000280100001F00 ....(.....
0000D601000019000B00 ..........
12002001000000001FA3 .. .......
4F400000000012002001 O@...... .
010000007F010000FF00 ..........
000000000000201F1040 ...... ..@
2B000100 +...
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
