Yeah, checking the code I see the string match for byte_test with an
example.
There also seems to be a 10 byte limitation with string, as in, I should be
using a content match. So 1,2,4 bytes for all.
Really though, isn't this perfect for the DNS Preprocessor as it checks tcp
and udp traffic on port 53?
Or at least a shared object rule :-)
Shirkdog
http://www.shirkdog.us
From: Brian <bmc@snort.org>
To: "M. Shirk" <shirkdog_list@hotmail.com>
CC: Snort-sigs@lists.sourceforge.net, rmkml@free.fr,bhartstein@demarc.com
Subject: Re: [Snort-sigs] new rule for detect windows NAT DNS DoS
Date: Tue, 31 Oct 2006 11:05:21 -0500
On Tue, Oct 31, 2006 at 11:22:08AM -0500, M. Shirk wrote:
This is what I had.
Its the Query, with the other values set to null.
alert tcp $HOME_NET any -> any 53 (msg:"DNS Goes bad on Windows";
content:"|01 00|"; offset: 2; byte_test:8,=,0,0,relative; rev:1;
sid:666; )
commentary:
- using content where you should be using byte_test
- using byte_test where you should be using content
- even if byte_test was the correct rule option for the data it is
being used to compare against (which it isn't), byte_test can only read
up to 4 bytes of data. [0]
Fixup suggestions:
1) Check the single bit with byte_test
2) Check the 8 bytes of null with content
Brian
0 - string mode is different. but you are not using string mode, so
don't worry about it.
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
_________________________________________________________________
Add a Yahoo! contact to Windows Live Messenger for a chance to win a free
trip!
http://www.imagine-windowslive.com/minisites/yahoo/default.aspx?locale=en-us&hmtagline
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
