Client is: Redhat 7.3, i386
rsync version 2.5.4 protocol version 26
Server is: Fedora 6, i386
rsync version 2.6.9 protocol version 29
I can unfortunately not provide dumps directly from our production, will
have to see if I can replicate this in the lab.
Here is some example Payload:
length =3D 16
000 : A8 00 00 00 38 01 00 00 BC 02 00 00 00 01 00 00 ....8...........
length =3D 4
000 : A2 00 00 00 ....
length =3D 704
000 : 9F 00 00 00 A7 00 00 00 BC 02 00 00 C4 00 00 00 ................
010 : FF FF FF FF FE FF FF FF FD FF FF FF FC FF FF FF ................
020 : FB FF FF FF FA FF FF FF F9 FF FF FF F8 FF FF FF ................
030 : F7 FF FF FF F6 FF FF FF F5 FF FF FF F4 FF FF FF ................
040 : F3 FF FF FF F2 FF FF FF F1 FF FF FF F0 FF FF FF ................
050 : EF FF FF FF EE FF FF FF ED FF FF FF EC FF FF FF ................
060 : EB FF FF FF EA FF FF FF E9 FF FF FF E8 FF FF FF ................
070 : E7 FF FF FF E6 FF FF FF E5 FF FF FF E4 FF FF FF ................
080 : E3 FF FF FF E2 FF FF FF E1 FF FF FF E0 FF FF FF ................
090 : DF FF FF FF DE FF FF FF DD FF FF FF DC FF FF FF ................
0a0 : DB FF FF FF DA FF FF FF D9 FF FF FF D8 FF FF FF ................
0b0 : D7 FF FF FF D6 FF FF FF D5 FF FF FF D4 FF FF FF ................
0c0 : D3 FF FF FF D2 FF FF FF D1 FF FF FF D0 FF FF FF ................
0d0 : CF FF FF FF CE FF FF FF CD FF FF FF CC FF FF FF ................
0e0 : CB FF FF FF CA FF FF FF C9 FF FF FF C8 FF FF FF ................
0f0 : C7 FF FF FF C6 FF FF FF C5 FF FF FF C4 FF FF FF ................
100 : C3 FF FF FF C2 FF FF FF C1 FF FF FF C0 FF FF FF ................
110 : BF FF FF FF BE FF FF FF BD FF FF FF BC FF FF FF ................
120 : BB FF FF FF BA FF FF FF B9 FF FF FF B8 FF FF FF ................
130 : B7 FF FF FF B6 FF FF FF B5 FF FF FF B4 FF FF FF ................
140 : B3 FF FF FF B2 FF FF FF B1 FF FF FF B0 FF FF FF ................
150 : AF FF FF FF AE FF FF FF AD FF FF FF AC FF FF FF ................
160 : AB FF FF FF AA FF FF FF A9 FF FF FF A8 FF FF FF ................
170 : A7 FF FF FF A6 FF FF FF A5 FF FF FF A4 FF FF FF ................
180 : A3 FF FF FF A2 FF FF FF A1 FF FF FF A0 FF FF FF ................
190 : 9F FF FF FF 9E FF FF FF 9D FF FF FF 9C FF FF FF ................
1a0 : 9B FF FF FF 9A FF FF FF 99 FF FF FF 98 FF FF FF ................
1b0 : 97 FF FF FF 96 FF FF FF 95 FF FF FF 94 FF FF FF ................
1c0 : 93 FF FF FF 92 FF FF FF 91 FF FF FF 90 FF FF FF ................
1d0 : 8F FF FF FF 8E FF FF FF 8D FF FF FF 8C FF FF FF ................
1e0 : 8B FF FF FF 8A FF FF FF 89 FF FF FF 88 FF FF FF ................
1f0 : 87 FF FF FF 86 FF FF FF 85 FF FF FF 84 FF FF FF ................
200 : 83 FF FF FF 82 FF FF FF 81 FF FF FF 80 FF FF FF ................
210 : 7F FF FF FF 7E FF FF FF 7D FF FF FF 7C FF FF FF =7F...~...}...|...
220 : 7B FF FF FF 7A FF FF FF 79 FF FF FF 78 FF FF FF {...z...y...x...
230 : 77 FF FF FF 76 FF FF FF 75 FF FF FF 74 FF FF FF w...v...u...t...
240 : 73 FF FF FF 72 FF FF FF 71 FF FF FF 70 FF FF FF s...r...q...p...
250 : 6F FF FF FF 6E FF FF FF 6D FF FF FF 6C FF FF FF o...n...m...l...
260 : 6B FF FF FF 6A FF FF FF 69 FF FF FF 68 FF FF FF k...j...i...h...
270 : 67 FF FF FF 66 FF FF FF 65 FF FF FF 64 FF FF FF g...f...e...d...
280 : 63 FF FF FF 62 FF FF FF 61 FF FF FF 60 FF FF FF c...b...a...`...
290 : 5F FF FF FF 5E FF FF FF 5D FF FF FF 5C FF FF FF _...^...]...\...
2a0 : 5B FF FF FF 5A FF FF FF 59 FF FF FF 00 00 00 00 [...Z...Y.......
2b0 : 34 E8 4B BD 3B E3 4B 60 0F 84 66 FF 8E 28 03 56 4.K.;.K`..f..(.V
-----Original Message-----
From: rmkml [mailto:rmkml@free.fr]
Sent: 30 July 2007 02:42
To: Christiaan Ehlers
Subject: Re: [Snort-sigs] rsync problem
Hi Christiaan,
please send full payload and snort alert
and maybe send tcpdump trace on rsync session
what version of rsync client and server ? and on what platform ?
(os/hardware)
Regards
Rmkml
On Mon, 30 Jul 2007, Christiaan Ehlers wrote:
Date: Mon, 30 Jul 2007 19:21:26 +0100
From: Christiaan Ehlers <Christiaan.Ehlers@inclarity.co.uk>
To: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] rsync problem
Hi thanks for the response, It's a bit of a dumb error on my side!
Now I have the problem that I get a lot of false possitives on my
rsync.
All the rsync traffic is legit (I am very sure of this since I
personally triggerd all the alerts from my rsync client!)...
Could this be due to little/big endian issue between the client and
server? Anybody know the format of the rsync packet?
-----Original Message-----
From: snort-sigs-bounces@lists.sourceforge.net
[mailto:snort-sigs-bounces@lists.sourceforge.net] On Behalf Of Nigel
Houghton
Sent: 30 July 2007 19:12
To: snort-sigs@lists.sourceforge.net
Subject: Re: [Snort-sigs] rsync problem
On 0, Christiaan Ehlers <Christiaan.Ehlers@inclarity.co.uk> wrote:
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D
=3D3D
length =3D3D 4
000 : A4 00 00 00 ....
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D
=3D3D
If we step through this rule we see that first 2 bytes are A4
which
is
not more than 4000! The rest of the rule is satisfied though...
The first two bytes are "A4 00" which is decimal 41984.
--
Nigel Houghton
Office Linebacker
SF VRT
------------------------------------------------------------------------
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a
browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
Disclaimer=3D0A=3D
=3D0A=3D
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
=3D3D=3D
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3=
D=3D3D=3D3D=3D0A=3D
=3D0A=3D
This email and any files transmitted with it are confidential and=3D0A=3D
intended solely for the use of the individual or entity to whom
they=3D0A=3D
are addressed. If you have received this email in error please
notify=3D0A=3D
the system manager. Please note that any views or opinions
presented=3D0A=3D
in this email are solely those of the author and do not
necessarily=3D0A=3D
represent those of the company. Finally, the recipient should
check=3D0A=3D
this email and any attachments for the presence of viruses. The=3D0A=3D
company accepts no liability for any damage caused by any virus=3D0A=3D
transmitted by this email.=3D0A=3D
=3D0A=3D
=3D0A=3D
Inclarity Ltd.=3D0A=3D
=3D0A=3D
Registered Office: Olympic Office Centre, Fulton Road, Wembley, =3D0A=3D
Middlesex, HA9 0NU=3D0A=3D
Telephone: + 44 (0)845 698 0800=3D0A=3D
Fax: + 44 (0)845 698 1000=3D0A=3D
=3D0A=3D
Registered Company No. 02673204=3D0A=3D
=3D0A=3D
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D
=3D3D=3D
=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3D=3D3=
D=3D3D=3D3D
------------------------------------------------------------------------
-
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a
browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
Disclaimer=0A=
=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A=
=0A=
This email and any files transmitted with it are confidential and=0A=
intended solely for the use of the individual or entity to whom they=0A=
are addressed. If you have received this email in error please notify=0A=
the system manager. Please note that any views or opinions presented=0A=
in this email are solely those of the author and do not necessarily=0A=
represent those of the company. Finally, the recipient should check=0A=
this email and any attachments for the presence of viruses. The=0A=
company accepts no liability for any damage caused by any virus=0A=
transmitted by this email.=0A=
=0A=
=0A=
Inclarity Ltd.=0A=
=0A=
Registered Office: Olympic Office Centre, Fulton Road, Wembley, =0A=
Middlesex, HA9 0NU=0A=
Telephone: + 44 (0)845 698 0800=0A=
Fax: + 44 (0)845 698 1000=0A=
=0A=
Registered Company No. 02673204=0A=
=0A=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
