Better then commenting the rule out, can you file a false positive
report?
Joel
On Mar 29, 2006, at 10:07 AM, Briggs, Bruce wrote:
In your snort.conf, the default value for your SQL servers is:
var SQL_SERVERS $HOME_NET
Replace $HOME_NET with the actual IP addrs of any internal SQL
servers.
Or comment out the alert for SID 2329 in sql.rules.
Then you won't see these false positives any more.
Many use Oinkmaster to manage commented out alerts across Snort
signature updates.
Bruce
From: snort-users-admin@lists.sourceforge.net [mailto:snort-users-
admin@lists.sourceforge.net] On Behalf Of Jeffery Gunter
Sent: Wednesday, March 29, 2006 8:54 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] MS-SQL Probe when listening to streaming
radio! ???
Hi Folks;
I’m quite new to snort. I have a user using Win Media Player to
listen to streaming radio from WIMZ out of Knoxville, TN. My issue
is that it is causing snort to go crazy. I've received over 100 of
the following messages:
IDS:S=snort:ID=1:[1:2329:6] MS-SQL probe response overflow attempt
[Classification: Attempted User Privilege Gain] [Priority: 1]:
{UDP} 66.250.188.37:2267 -> 10.88.220.65:1215
My user's ip is 65 and when I had her stop accessing the stream the
messages stopped? What is up with this? I have no SQL services
running on her computer?
Thanks for your help!
J
Jeffery Gunter | Chief Information Officer | Citizens Bank of
East Tennessee | http://www.cbetn.com
email: jgunter@cbetn.com
Land: 423-272-2200 x17
Cell: 423-754-5157
Fax: 423-272-2322
------_>extPart_001_01C65338.3329CF40--
This e-mail was scanned for viruses.
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
