-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Heh. I wrote those rules a while back before I came to work for
Sourcefire. At the time botnets were all over the place and there was
really no way to detect how they were getting in, so I wrote them with
the theory that all botnets were IRC at the time.
(The rules are basically the same at the Snort.org rules)
The tag was included in order to do exactly that, track botnets. I used
to log in binary mode, so when a botnet was on the network, I could
reconstruct the whole session. Since IRC was not allowed on our
networks (I was .mil), it was easy to track down botnets (plus anyone
that was using IRC was in violation, so we got them too). However, on a
university network, this won't work, as IRC is allowed.
I would either A) remove the tag from the rule, or B) suppress actual
IRC servers based off the server IP. Since B is alot of work, A may be
faster.
tag 'alerts' are logged to db because they are under the "log" directive
as opposed to the "alert" directive. Therefore they go to your db, as
the actual rule that triggered it goes to the alert file.
Joel
Rob Ward wrote:
--On 26 May 2006 09:40 -0400 Joel Esler <joel.esler@sourcefire.com> wrote:
Suppose you can copy and paste (take out the IP's) the alert you are
getting?
Joel
Strange - these aren't appearing in my sensors alert files only the
database and seem to be related to the following alerts triggered by a
Bleeding Snort Rule which DO appear in the alert file:
[**] [1:2000347:5] BLEEDING-EDGE ATTACK RESPONSE IRC - Private message on
non-std port [**] [Classification: A Network Trojan was detected]
[Priority: 1]
05/26-14:54:24.064891 0:9:E9:A5:F8:0 -> 0:E:39:92:4C:0 type:0x800
len:0x6A
X.X.X.X:2353 -> 85.158.9.6:8000 TCP TTL:127 TOS:0x0 ID:8172
IpLen:20 DgmLen:92 DF ***AP*** Seq: 0x1EA9AEA7 Ack: 0x769ADDBF Win:
0xFC00 TcpLen: 20
On investigation the majority of these are false positives but some can
be linked to Botnets.
The corresponding Tagged Packet alert that's in the database is:
Generated by BASE v1.2.2 (cindy) on Fri, 26 May 2006 15:06:19 +0100
-------------------------------------------------------------------------
-----
# (6 - 221802) [2006-05-26 14:54:24] [snort/1] Tagged Packet
IPv4: X.X.X.X -> 85.158.9.6
hlen=5 TOS=0 dlen=92 ID=8172 flags=0 offset=0 TTL=127 chksum=16965
TCP: port=2353 -> dport: 8000 flags=***AP*** seq=514436775
ack=1989860799 off=5 res=0 win=64512 urp=0 chksum=46007
Payload: length = 52
000 : 50 52 49 56 4D 53 47 20 23 75 6B 5F 6C 69 76 65 PRIVMSG #uk_live
010 : 72 70 6F 6F 6C 5F 63 72 75 69 73 69 6E 67 20 3A rpool_cruising :
020 : 41 4E 59 31 20 57 41 4E 4E 41 20 43 48 41 54 3F ANY1 WANNA CHAT?
030 : 3F 3F 0D 0A ??..
Thanks
Rob Ward
Network Northwest Support
University of Liverpool
Computing Services Department
-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
- --
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFEdw6nKbCSyXHckt4RAqbXAJ9Ts4YDlhyxiIAeLNcDKHOsXJNIyQCdHGtU
lPfLiZTK0PRib3UTp8YQZSY=
=zULI
-----END PGP SIGNATURE-----
-------------------------------------------------------
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
