Snort Stream4
Results 1 to 6 of 6

Thread: Snort Stream4

  1. #1
    Senior Member
    Join Date
    Jun 2003
    Posts
    236

    Arrow Snort Stream4

    Seems like there quite a few who know snort well here and Im hoping I can get an answere here faster than the snort mailing list ....

    Stream4:
    Ok so supposedly this reassembles a tcp stream. So a single email being sent should all be reassembled?
    Basically some rules I developed scan for 2 parts of content in an email one at the begining and one at the end. Since the email will be large generally it will be sent in multiple packets. If I scan for the content seperatly both rules would trigger. But when I combine them into 1 rule with stream4 reassemble on it does not alert. Am I missing something?
    That which does not kill me makes me stronger -- Friedrich Nietzche

  2. #2
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Location
    Redondo Beach, CA
    Posts
    7,324
    Perhaps if you posted the single rule, people can look at it and make suggestions?
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage

  3. #3
    Member
    Join Date
    Jan 2004
    Posts
    36
    yeah.... i had problems with that......

    go on www.google.com and search about it and it will tell u what u need....

    peace...

  4. #4
    Yes, that's my CC number! 576869746568617's Avatar
    Join Date
    Dec 2003
    Location
    Earth
    Posts
    397
    hodzic: WTF!

    yeah.... i had problems with that......

    go on www.google.com and search about it and it will tell u what u need....

    peace...
    We're not noobs...I'm sure S3cur|ty4ng31 knows Google is his friend.

    MsMittens: I have a request. Could you see what could be done about having the AntiPoints system auto-assign negs for nonsence posts?

    S3cur|ty4ng31:

    I had a similar problem trying to use stream4, but I just decided that 2 rules were better than none! In this case, however, it would be better if there were only one. I haven't a clue why it didn't work and didn't bother to find out.

    Ask Q.o.D

  5. #5
    Senior Member
    Join Date
    Jun 2003
    Posts
    236
    Heres the rule, basically Im just trying to make the perfect Novarg/Mydoom rule that will have no false positives.

    alert tcp any any -> any 25 (msg:"Virus - Novarg/Mydoom";content:"VVBY"; content:"JmpvZT9uZW8v"; sid:31337; classtype:misc-activity; rev:2; reference:url,www.cert.org/incident_notes/IN-2004-01.html;)

    the VVBY comes with in the first 640 bytes and JmpvZT9uZW8v is later in the email.
    And in my snort.conf i have

    preprocessor stream4_reassemble

    If I had the rules like this

    alert tcp any any -> any 25 (msg:"Virus - Novarg/Mydoom"; content:"JmpvZT9uZW8v"; sid:31337; classtype:misc-activity; rev:2; reference:url,www.cert.org/incident_notes/IN-2004-01.html;)

    alert tcp any any -> any 25 (msg:"Virus - Novarg/Mydoom";content:"VVBY" ; sid:31338; classtype:misc-activity; rev:2; reference:url,www.cert.org/incident_notes/IN-2004-01.html;)


    both would trigger on a single email

    Originally posted here by hodzic
    yeah.... i had problems with that......

    go on www.google.com and search about it and it will tell u what u need....

    peace...
    Not to flame you, but this is not a very helpful post. Ive been to google and Ive read the snort 2.1.0 manual and to may understanding this is how it works, so if you had the same problem and you found what you need you could just post it, but I suspect you dont.
    That which does not kill me makes me stronger -- Friedrich Nietzche

  6. #6
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Location
    Redondo Beach, CA
    Posts
    7,324
    May sound stupid but spacing? Lemme think about this.. I've done a few rules and usually individually...
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •