Re: [Snort-sigs] Rule for identifying all trafic except the specefied

Chich Thierry wrote:
> > alert tcp any any ->  192.168.3.74 20 (msg:"Foo rule";
> > flow:to_server,established; content:"FOOBAR"; flowbits:set,allblock;
> > flowbits:noalert;)
> >
> > alert tcp any any -> 192.168.3.74 20 (msg:"Test Rule"; rev:1;
> > pcre:"/.*/sm"; flowbits:isnotset,allblock; fwsam: src, 10 minutes;)
>
>
> I don't understand why there is the need for the pcre. It looks useless to me.

Same here, but the rule was not working with out the pcre. Infact I wasted a 
lot of time 
trying to figure out why the rule was not working, and finally tried the pcre 
just as a 
trial and it worked.

> Furthermore, these rules will  only detect something strange on the FTP-DATA 
> port. The exploits are more currently using commands (port 21). 

Our objective was to flag an alert (and block using snortsam) if any traffic 
other than 
the one specefied was going to the ftp server.

> Last but not least, if you really want to look  pattern in the DATA traffic,  
>  
> it won't work when the client is using the passive mode. The FTP-DATA port is 
> no more longer 20, but an arbitrary port.

Agreed, will modify the rule here.

raj


_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs