Home / Browse / Snort / Mail / Archive

Snort

Email Archive: snort-users (read-only)

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: Joel Esler <jesler@so...> - 2011-02-01 18:56

That's not right.  I'll bug this on our side for our developers to take a
look.
Joel

On Tue, Feb 1, 2011 at 1:53 PM, Michael Scheidell <
michael.scheidell@...> wrote:

>
> On 2/1/11 1:48 PM, Joel Esler wrote:
>
> And the only difference is to add in the --enable-flexresp3?
>
>  Joel
>
> yes.  then everything is fine.
> I might mention that I also have to oinkmaster out resp:* rules also, but
> that I expected.  I didn't expect sensitive data rules to fail.
>
> I am regres testing ports build options that a user can select.
> looking for combination that don't work, won't build, or won't work with
> VRT rules, ET rules, etc.
>
>
>
> --
> Michael Scheidell, CTO
> o: 561-999-5000
> d: 561-948-2259
> ISN: 1259*1300
> > *| *SECNAP Network Security Corporation
>
>    - Certified SNORT Integrator
>    - 2008-9 Hot Company Award Winner, World Executive Alliance
>    - Five-Star Partner Program 2009, VARBusiness
>    - Best in Email Security,2010: Network Products Guide
>    - King of Spam Filters, SC Magazine 2008
>
>
> ------------------------------
>
> This email has been scanned and certified safe by SpammerTrap®.
> For Information please see http://www.secnap.com/products/spammertrap/
> ------------------------------
>
>


-- 
Joel Esler
Skype:eslerjoel
http://blog.snort.org && http://blog.clamav.net

Thread View

Thread	Author	Date
[Snort-users] Rules with SDF options cannot have other detection options in the same rule	Michael Scheidell <michael.scheidell@se...>

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: Joel Esler <jesler@so...> - 2011-02-01 18:48

Attachments: Message as HTML

And the only difference is to add in the --enable-flexresp3?

Joel

On Tue, Feb 1, 2011 at 11:27 AM, Michael Scheidell <
michael.scheidell@...> wrote:

>  when compiling snort WITHOUT flexresp3, SDF rules will fail:
>
> ERROR: /usr/local/etc/snort/./preproc_rules/sensitive-data.rules(1) Rules
> with SDF options cannot have other detection options in the same rule.
>
> this ./configure:
>
> --enable-dynamicplugin --enable-build-dynamic-examples  --enable-reload
> --enable-reload-restart  --disable-corefiles
> --with-dnet-includes=/usr/local/include/libnet11
> --with-dnet-libraries=/usr/local/lib/libnet11 --with-mysql=no --with-odbc=no
> --with-postgresql=no --disable-prelude --enable-gre --enable-mpls
> --enable-decoder-preprocessor-rules --enable-zlib-enable-normalizer
> --prefix=/usr/local
>
> i googled, but only see this: (with no answer yet)
> <http://seclists.org/snort/2010/q2/826><http://seclists.org/snort/2010/q2/826>
>
> if the answer is 'add --enable-flexresp3'.  then fine, but it doesn't make
> sense unless I don't understand the error.
>
> stock sensitive-data.rules:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET [80,20,25,143,110]
> (msg:"SENSITIVE-DATA Credit Card Numbers"; metadata:service
> http, service smtp, service ftp-data, service imap, service pop3;
> sd_pattern:2,credit_card; classtype:sdf; sid:2; gid:138;
> rev:1;)
>
>
> --
> Michael Scheidell, CTO
> o: 561-999-5000
> d: 561-948-2259
> ISN: 1259*1300
> > *| *SECNAP Network Security Corporation
>
>    - Certified SNORT Integrator
>    - 2008-9 Hot Company Award Winner, World Executive Alliance
>    - Five-Star Partner Program 2009, VARBusiness
>    - Best in Email Security,2010: Network Products Guide
>    - King of Spam Filters, SC Magazine 2008
>
>
> ------------------------------
>
> This email has been scanned and certified safe by SpammerTrap®.
> For Information please see http://www.secnap.com/products/spammertrap/
> ------------------------------
>
>
>
> ------------------------------------------------------------------------------
> Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
> Finally, a world-class log management solution at an even better
> price-free!
> Download using promo code Free_Logger_4_Dev2Dev. Offer expires
> February 28th, so secure your free ArcSight Logger TODAY!
> http://p.sf.net/sfu/arcsight-sfd2d
> _______________________________________________
> Snort-users mailing list
> Snort-users@...
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>



-- 
Joel Esler
Skype:eslerjoel
http://blog.snort.org && http://blog.clamav.net

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: Michael Scheidell <michael.scheidell@se...> - 2011-02-01 18:53

Attachments: Message as HTML

On 2/1/11 1:48 PM, Joel Esler wrote:
> And the only difference is to add in the --enable-flexresp3?
>
> Joel
yes.  then everything is fine.
I might mention that I also have to oinkmaster out resp:* rules also, 
but that I expected.  I didn't expect sensitive data rules to fail.

I am regres testing ports build options that a user can select.
looking for combination that don't work, won't build, or won't work with 
VRT rules, ET rules, etc.

-- 
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
 >*| *SECNAP Network Security Corporation

    * Certified SNORT Integrator
    * 2008-9 Hot Company Award Winner, World Executive Alliance
    * Five-Star Partner Program 2009, VARBusiness
    * Best in Email Security,2010: Network Products Guide
    * King of Spam Filters, SC Magazine 2008

______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: Joel Esler <jesler@so...> - 2011-02-01 18:56

Attachments: Message as HTML

That's not right.  I'll bug this on our side for our developers to take a
look.
Joel

On Tue, Feb 1, 2011 at 1:53 PM, Michael Scheidell <
michael.scheidell@...> wrote:

>
> On 2/1/11 1:48 PM, Joel Esler wrote:
>
> And the only difference is to add in the --enable-flexresp3?
>
>  Joel
>
> yes.  then everything is fine.
> I might mention that I also have to oinkmaster out resp:* rules also, but
> that I expected.  I didn't expect sensitive data rules to fail.
>
> I am regres testing ports build options that a user can select.
> looking for combination that don't work, won't build, or won't work with
> VRT rules, ET rules, etc.
>
>
>
> --
> Michael Scheidell, CTO
> o: 561-999-5000
> d: 561-948-2259
> ISN: 1259*1300
> > *| *SECNAP Network Security Corporation
>
>    - Certified SNORT Integrator
>    - 2008-9 Hot Company Award Winner, World Executive Alliance
>    - Five-Star Partner Program 2009, VARBusiness
>    - Best in Email Security,2010: Network Products Guide
>    - King of Spam Filters, SC Magazine 2008
>
>
> ------------------------------
>
> This email has been scanned and certified safe by SpammerTrap®.
> For Information please see http://www.secnap.com/products/spammertrap/
> ------------------------------
>
>


-- 
Joel Esler
Skype:eslerjoel
http://blog.snort.org && http://blog.clamav.net

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: Michael Scheidell <michael.scheidell@se...> - 2011-02-01 19:00

Attachments: Message as HTML

On 2/1/11 1:56 PM, Joel Esler wrote:
> That's not right.  I'll bug this on our side for our developers to 
> take a look.
> Joel
>
Could be platform dependent.
platform, freebsd 7.3, amd64. note that I do NOT have ipv6 in those 
options. also note, aside from the resp: stuff in chat rules to keep 
them quiet, the VRT rules are mostly stock.

might be snort.conf.

if you can't duplicate it, I'll send snort.conf private.

-- 
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
 >*| *SECNAP Network Security Corporation

    * Certified SNORT Integrator
    * 2008-9 Hot Company Award Winner, World Executive Alliance
    * Five-Star Partner Program 2009, VARBusiness
    * Best in Email Security,2010: Network Products Guide
    * King of Spam Filters, SC Magazine 2008

______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: Michael Scheidell <michael.scheidell@se...> - 2011-02-01 19:35

Attachments: Message as HTML

On 2/1/11 1:56 PM, Joel Esler wrote:
> That's not right.  I'll bug this on our side for our developers to 
> take a look.
> Joel
>
Would you consider it a bug to fail on a signal 30, if system build with 
targetbased, and doesn't have a targets.xml file?

You might ask, why send a signal 30 to reload the targets.xml file if 
you don't have system compiled with --enable-targetbased?

(freebsd sends a signal 30 is you send it a SIGUSR1)

I might ask, if --enable-targetbased is NOT specified, why include the 
code to look for the targets.xml file?

-- 
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
 >*| *SECNAP Network Security Corporation

    * Certified SNORT Integrator
    * 2008-9 Hot Company Award Winner, World Executive Alliance
    * Five-Star Partner Program 2009, VARBusiness
    * Best in Email Security,2010: Network Products Guide
    * King of Spam Filters, SC Magazine 2008

______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: Joel Esler <jesler@so...> - 2011-02-01 20:00

On Feb 1, 2011, at 2:35 PM, Michael Scheidell wrote:
> On 2/1/11 1:56 PM, Joel Esler wrote:
>> 
>> That's not right.  I'll bug this on our side for our developers to take a look.  
>> Joel
>> 
> Would you consider it a bug to fail on a signal 30, if system build with targetbased, and doesn't have a targets.xml file?
> 
> You might ask, why send a signal 30 to reload the targets.xml file if you don't have system compiled with --enable-targetbased?
> 
> (freebsd sends a signal 30 is you send it a SIGUSR1)
> 
> I might ask, if --enable-targetbased is NOT specified, why include the code to look for the targets.xml file?


--enable-targetbased, I thought, was on and built in by default in recent versions.  So I am not sure where the bug lies.  sig 30 for Snort?  Or freebsd for sending a sig 30 on a USR1?  Not sure here.

--
Joel Esler
jesler@...
http://blog.snort.org && http://blog.clamav.net

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: waldo kitty <wkitty42@wi...> - 2011-02-02 02:29

On 2/1/2011 11:27, Michael Scheidell wrote:
> when compiling snort WITHOUT flexresp3, SDF rules will fail:

FWIW: i have had to completely disable or suppress the sensitive data rules for 
the networks i maintain... they false waaaaaaaay too much... especially where 
serialized URLs are used (ie: forum traffic)... the main culprit being "SSNs 
without dashes" but "SSNs with dashes" also failed quite a lot on traffic that 
had serialized transactions where dashes were used in the numbers...

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: waldo kitty <wkitty42@wi...> - 2011-02-02 02:32

On 2/1/2011 13:56, Joel Esler wrote:
> That's not right.  I'll bug this on our side for our developers to take a look.


will this result in fixes for older versions or only the newer 2.9 stuff??

Re: [Snort-users] Rules with SDF options cannot have other detection options in the same rule

From: Joel Esler <jesler@so...> - 2011-02-02 02:43

Attachments: Message as HTML

If it results in a fix, it will only go into newer versions.  We don't patch
older versions, we just update.

J

On Tue, Feb 1, 2011 at 9:32 PM, waldo kitty <wkitty42@...> wrote:

> On 2/1/2011 13:56, Joel Esler wrote:
> > That's not right.  I'll bug this on our side for our developers to take a
> look.
>
>
> will this result in fixes for older versions or only the newer 2.9 stuff??
>
>
> ------------------------------------------------------------------------------
> Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
> Finally, a world-class log management solution at an even better
> price-free!
> Download using promo code Free_Logger_4_Dev2Dev. Offer expires
> February 28th, so secure your free ArcSight Logger TODAY!
> http://p.sf.net/sfu/arcsight-sfd2d
> _______________________________________________
> Snort-users mailing list
> Snort-users@...
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>



-- 
Joel Esler
Skype:eslerjoel
http://blog.snort.org && http://blog.clamav.net