Re: [Snort-sigs] Storm worm rule

offset is counted from the beginning of payload, and dsize is the size 
of payload.  So if the payload is only 2 to 25 bytes then offset can't 
be 47 cause that is outside the bounds of the payload.

I'm assuming |10 a6| is in the first couple bytes of the UDP payload so 
your offset is most like 0 if it's the first two bytes of the payload.

Cheers,
-matt

Paul Schmehl wrote:
> This is a packet capture of a known storm-infected host.  Normal data payload 
> size is either 2 bytes or 25 bytes.
>
> 0000  00 0f 23 aa 37 40 00 0d  ed ac 93 40 81 00 00 02   ..#.7@.. ...@....
> 0010  08 00 45 00 00 35 85 2b  00 00 74 11 ef 1c 81 6e   ..E..5.+ ..t....n
> 0020  f1 06 80 67 df 93 f7 9b  1c 52 00 21 94 10 10 a6   ...g.... .R.!....
> 0030  4b 69 53 29 56 b1 29 22  8b a9 ad 3c 22 0b 3a 8d   KiS)V.)" ...<".:.
> 0040  e2 53 17 15 81 49 46                               .S...IF
>
> The signature |10 a6| at byte 47 is the indication of an encrypted eDonkey 
> session (typically used by Storm along with UDP.
>
> So, would this be the correct syntax?  alert udp blah(msg:"blah"; 
> dsize:2<>25; 
> content:"|10 a6|"; offset:47; blah.  Or am I missing something?


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs