Try oinkmaster
On 2/21/06, Christina McAghon <cmcaghon@sungardsct.com> wrote:
I am running snort v2.3.3. I would like to change the priority of a few
certain rules (without affecting the default classification.config
priority). I thought I could achieve this by copying the rule from its rule
file into local.rules. In local.rules, I added the priority classification.
Here's an example:
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$
unicode share access"; flow:established,to_server; content:"|00|"; depth:1;
content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative;
pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24
00 00 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc;
classtype:protocol-command-decode; priority:2; sid:2466;
rev:7;)
The problem is that this rule doesn't trigger. If I modify the rule to not
include the sid and rev, it will trigger:
alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"NETBIOS SMB-DS IPC$
unicode share access"; flow:established,to_server; content:"|00|"; depth:1;
content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative;
pcre:"/^.{27}/R"; byte_jump:2,7,little,relative; content:"I|00|P|00|C|00 24
00 00 00|"; distance:2; nocase; flowbits:set,smb.tree.connect.ipc;
classtype:protocol-command-decode; priority:2;)
However, I would like to keep the sid information. Is that possible? Or is
there a better way to achieve this?
Thanks,
Christina
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
