We modify the rule to make it less noisy:
var MULTICAST_NET 224.0.0.0/4
alert ip any any -> !$MULTICAST_NET any (msg:"BAD-TRAFFIC IP Proto 103 PIM";
ip_proto:103; reference:bugtraq,8211; reference:cve,2003-0567;
reference:nessus,11791; classtype:non-standard-protocol; sid:2189; rev:4;)
Here's the line in oinkmaster.conf that performs the modification:
modifysid 2189 "->\s*any" | "-> !\$MULTICAST_NET"
Cheers,
-- greg
---------- Original Message ----------
Subject: [Snort-users] non-standard-protocol : BAD-TRAFFIC IP Proto 103 PIM
Date: Thu, 17 May 2007 04:21:56 -0700
From: "David Ryan" <David.Ryan@Quintiles.com>
To: <snort-users@lists.sourceforge.net>
Hi all,
I am seeing loads (like 90% of all events) of these events showing up on
one of my Snort sensors. I have looked at the description here -
_http://www.snort.org/pub-bin/sigs.cgi?sid=2189_ - and I looked at the
rule definition and it appears to match simply on the existence of IP
protocol 103 as distinct from any payload within it.
I see the traffic coming from two known Cisco routers on the subnet I'm
monitoring and the traffic is destined for 224.0.0.13 which is the
multicast address for PIM -
_http://www.networksorcery.com/enp/protocol/pim.htm_ I have also I have
seen it on other sites and subnets on the network I am monitoring, so I
guess whatever function is causing this traffic to originate from the
router is used across the organisation.
In order to make the output from snort a little more readable (and
because it is matching on the protocol and not the payload) I have
disabled this rule. I know the protocol in question is a
routing-related protocol, but does anyone have any views or explanation
on the normal use of this protocol ?
Thanks,
David
===========================================
David Ryan
IT Security Engineer, Global IT Security
Quintiles, Global IT - Infrastructure, QDUB
david.ryan@quintiles.com
v: +353-1-819-5186, GMT+0
m: +353-87-124-9108
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
