[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-sigs
Subject:    Re: [Snort-sigs] SID: 8440
From:       Patrik Israelsson <patrik.israelsson () sentor ! se>
Date:       2007-04-24 22:56:20
Message-ID: 200704250056.20741.patrik.israelsson () sentor ! se
[Download RAW message or body]

On Tuesday 24 April 2007 19.23, Paul Schmehl wrote:
> > For what it's worth, I've deactivated this sig since long since it was
> > giving  way too many false positives. We run NIDS services for a whole
> > bunch of  companies and this sig has triggered massively on our sensors
> > in pretty much  every network we've connected them to. So I'm fairly
> > confident that what  you're seeing is not clients trying to exploit a
> > vulnerability, rather they  are just going about their usual business and
> > this Snort sig is interpreting  it incorrectly.
>
> The sig is doing precisely what it's supposed to be doing.  The question
> is, is what it's being asked to do correct?  And if so, why are clients
> routinely trying to overflow a buffer?  Is it a massive misinterpretation
> of the protocol?  Is the sig written incorrectly?
>
> I'm hesitant to disable alerts simply because they're noisy.  I prefer to
> know why they're noisy and correct the problem.

Aye, I agree with you there. I'm not saying all noisy rules should be 
discarded per se, and it's very good that you're bringing this up - I've been 
curious myself why this sig is giving so many false positives. What I'm 
saying is simply that - it IS giving many false positives, that is, I've seen 
it alert on traffic from common legit clients of all kinds. While it's 
certainly possible that the rule is correctly written and all clients are 
misinterpreting the protocol, I'd say it's not very likely. Again, that in 
itself is of course not really enough to supress the rule altogether. It's 
always best to learn what the rule is doing instead, only problem is that 
doing that for every rule giving false positives would be _very_ time 
consuming. So I'm looking forward to the answer :-)

Regards,
Patrik

-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[prev in list] [next in list] [prev in thread] [next in thread]