Chich,
Would you have any problem with these rules going into the Community
ruleset? There was an agreement reached on Sept. 29th that all future
rules posted to the Snort-Sigs list would be incorporated into the
Community rules (see
http://marc.theaimsgroup.com/?l=snort-sigs&m=112803802610884&w=2), but
you've used "BLEEDING-EDGE" in your msg: fields, implying that you want
your rules included there.
There's certainly no problem with putting the rules in either set; I
just want to make sure that your wishes are respected. Please send an
e-mail indicating your preference (with a cross-post to
bleeding-sigs@bleedingsnort.com if you want to have the rules go there),
and I will ensure that either a) a Community pack including these is
released or b) the Bleedingsnort guys have been appropriately notified
so that they can take these rules.
Thanks,
Alex Kirk
Community Rules Manager
Sourcefire, Inc.
Regards,
I have written these two rules in order to detect video streams.
It is possible to precise the destination ports (554 for the first one, .1755
for the second one). However, I let them undefined in order to see if some
applications use these protocols on non standard ports.
alert tcp any any -> any any (msg: "BLEEDING-EDGE streaming RTSP (realpayer)";
content:"PLAY rtsp\://"; offset: 0; depth: 12; classtype: policy-violation;
reference:url,www.rtsp.org; rev: 1;)
alert tcp any any -> any any (msg: "BLEEDING-EDGE streaming Windows
Mediaplayer";content:"|01000000cefa0bb0|";offset: 0;depth: 8;
content:"MMS"; distance: 4; depth: 4;classtype: policy-violation;
reference:url,www.microsoft.com;rev:1;)
Thierry CHICH
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
