Here it goes Jeff,
I made a new pcap, this time with a "reset_dest" rule. It didnt work also. Cant
think of anything that could be wrong :\
The pcap was captured on the FTP (212.22.xx.xx). The remote client is the
193.xx.xx.xx.
Thanks again!
-pfeito
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Pfeito,
I'd like for you to try two things. First, try using only reset_dest
in your rule. Second, can you send me the pcap dump so I can take a
look at it?
The pcap dump I'm interested in will come from the FTP server. I want
to see all the packets from connection establishment to sp_respond2
firing the response packets.
- -Jeff
On Aug 30, 2004, at 7:05 AM, pfeito wrote:
Hi,
I'm currently testing flexresp2. For now I'm just using a simple rule
that
terminates a FTP connection if someone tries to login with user "root".
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP root login
attempt!";
flow:to_server,established; content:"USER"; nocase; content:"root";
distance:1; nocase; pcre:"/^USER\sroot/smi";
classtype:suspicious-login;
sid:1000002; rev:2; resp: reset_both;)
I try to login remotely with user root, but the connection does not
terminate. I sniffed with tcpdump and I know that it the TCP RST
packets are
being sent, but the connection stays up.
Then I tried the same but with both peers on the same LAN, but with
the same
results. The TCP RST packets are being sent also.
I've tcpdump logs if someone is interested in looking into them.
My snort.conf-flexresp2 config
config flexresp2_interface: eth2
config flexresp2_attempts: 10
What could be going wrong?
Thanks in advance,
-pfeito
-----Original Message-----
From: snort-users-admin@lists.sourceforge.net [mailto:snort-users-
admin@lists.sourceforge.net] On Behalf Of Jeff Nathan
Sent: segunda-feira, 26 de Julho de 2004 1:33
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] flexresp2 is back and needs testing
Hi Snortees,
I've got a new version of the flexible response code, sp_respond2,
ready for testing. This new version uses libdnet
(http://libdnet.sourceforge.net) and is significantly faster than all
previous versions. During testing I was able to reset TCP connections
where both the client and server were on the same LAN.
The patch is attached to this message but if you'd like to download
it,
it's also available from
http://cerberus.sourcefire.com/~jeff/archives/snort/sp_respond2/
If you encounter any problems with the attached patch, refer to the
website for an update before sending email.
It's most helpful if you're somewhat experienced with Snort. For the
time being I'd like to avoid tutoring users during testing.
- --
http://cerberus.sourcefire.com/~jeff (gpg/pgp key id 6923D3FD)
"Great spirits have always encountered violent opposition from
mediocre minds." - Albert Einstein
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)
iD8DBQFBMz1YEqr8+Gkj0/0RAqcCAKCqt6bNBfOHlqOYZIo6TXs0L0qt1gCbBJio
W7X45fODL7UYAHi+PBsCd+k=
=V4id
-----END PGP SIGNATURE-----
reset_dest.pcap
Description: reset_dest.pcap
