Richard Bejtlich wrote:
On 10/8/07, Matthew Watchinski <mwatchinski@sourcefire.com> wrote:
Richard Bejtlich wrote:
Say I create this snort.conf:
portvar MY_HTTP_PORTS [80,81,82,83,88,8000,8008,8080]
alert tcp any any -> any !$MY_HTTP_PORTS (msg:"Example Not"; sid:4;)
It alerts because
192.168.2.105:50970 -> 192.168.2.103:8000
is no different than
192.168.2.103:8000 -> 192.168.2.105:50970
cause you are running with any any -> any !PORTS
any any matches both 192.168.2.105:50970 -> 192.168.2.103:8000
and 192.168.2.103:8000 -> 192.168.2.105:50970
Hi Matt,
Thanks for your comments. I don't understand why these packets are
"no different". The MY_HTTP_PORTS variable includes 8000. If I
negate MY_HTTP_PORTS in my rule, why do I get an alert on
192.168.2.105:50970 -> 192.168.2.103:8000? Is it because port 8000 in
the packet is not other ports in the variable, like 80, 81, etc.?
NOTE: I've not had a chance to look at the code, I could be wrong,
please verify.
I think there may two issues working together.
1) not(80 and 81 and 82...) is different than (not 81 and not 81...)
2) not(80 and 81 and 82...) will always be true
I would expect the same behavior if you ran
$ nc -v 192.168.2.103 8001
as the command you are testing
$ nc -v 192.168.2.103 8000
because
not (80 and 81 and 82 and 83 and 88 and 8000 and 8008 and 8080) is
always true, it is not possible for a single port to be both 81 and 82
and thus when you negate the negative you get a positive.
Same rules apply when dealing with ip addresses IIRC.
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
