Quoting Sun <snortmaillist@gmail.com>:
For example, 'ICMP Timestamp Request' are from external to home, but
the 'ICMP Timestamp Reply' is still from external to home, then how can
we detect the reply from the home server?
If you believe that some outsider sending an ICMP Timestamp request is
an alertable event (because somebody is probing your network) the
first rule will alert you. If one of your inside machines *replies*
to the Timestamp request that should perhaps also be an alertable
event (because it means your firewall is misconfigured). The default
icmp.rules has no rule for the "my firewall is misconfigured" finding.
Perhaps it should. Nice catch.
Furthermore, 'ICMP Address Mask Reply' are from home to external,
That is to alert you that your firewall is misconfigured or the server
network options are misconfigured. Not a security finding as much as
a "heads-up" alert.
but 'ICMP Address Mask Reply undefined code' are from external to home,
To alert you to the fact that a server somewhere on your network is
sending out ICMP traffic that is totally bogus. That's a far more
scary thing than any of the others you've mentioned.
Consider the task of snort is to protect the user in home net, I
Wow, that is a messy subject:
eight years ago, the "task of snort" was to alert us to hackers
trying to break into our DNS servers and Mail servers (and send "shun"
commands to the firewall very quickly).
four years ago, the "task of snort" was to alert us to buffer
overruns, brute force attacks, and anomalous network traffic wether
sourced from inside or outside.
today, I would say that one of the most important "tasks of snort"
is to alert on internal malware infections, spyware infections, and
internal bots gone berzerk.
Can any body tell me whether my above oponion is correct or not?
All opinions are (by definition) *correct* including this one.
tc
-------------------------------------------------
Email solutions, MS Exchange alternatives and extrication,
security services, systems integration.
Contact: services@doctorunix.com
-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
