Hi thanks for the response, It's a bit of a dumb error on my side!
Now I have the problem that I get a lot of false possitives on my rsync.
All the rsync traffic is legit (I am very sure of this since I
personally triggerd all the alerts from my rsync client!)...
Could this be due to little/big endian issue between the client and
server? Anybody know the format of the rsync packet?
-----Original Message-----
From: snort-sigs-bounces@lists.sourceforge.net
[mailto:snort-sigs-bounces@lists.sourceforge.net] On Behalf Of Nigel
Houghton
Sent: 30 July 2007 19:12
To: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] rsync problem
On 0, Christiaan Ehlers <Christiaan.Ehlers@inclarity.co.uk> wrote:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
length =3D 4
000 : A4 00 00 00 ....
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
If we step through this rule we see that first 2 bytes are A4 which
is
not more than 4000! The rest of the rule is satisfied though...
The first two bytes are "A4 00" which is decimal 41984.
--
Nigel Houghton
Office Linebacker
SF VRT
------------------------------------------------------------------------
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
Disclaimer=0A=
=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=
=0A=
This email and any files transmitted with it are confidential and=0A=
intended solely for the use of the individual or entity to whom they=0A=
are addressed. If you have received this email in error please notify=0A=
the system manager. Please note that any views or opinions presented=0A=
in this email are solely those of the author and do not necessarily=0A=
represent those of the company. Finally, the recipient should check=0A=
this email and any attachments for the presence of viruses. The=0A=
company accepts no liability for any damage caused by any virus=0A=
transmitted by this email.=0A=
=0A=
=0A=
Inclarity Ltd.=0A=
=0A=
Registered Office: Olympic Office Centre, Fulton Road, Wembley, =0A=
Middlesex, HA9 0NU=0A=
Telephone: + 44 (0)845 698 0800=0A=
Fax: + 44 (0)845 698 1000=0A=
=0A=
Registered Company No. 02673204=0A=
=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
