Re: False Positive

Ok, I took a look at the packet and this is what I found.  First,
while the offset is 5 and that is where Snort started looking, the
depth to look was 15.  The |04 00| sequence was found at 5 (offset) +
13/14.  The |04 00| combination was actually found in the Request ID
field of the packet as apposed to the Community string.

With that said and after reading a little of the snmp_api.h code from
ucd-snmp, I wonder if you could do set this sig to a depth of 2.  It
appears that the 5 + 2 byte is the length of the community string,
allowing for a community string of 0 - 255 characters.  The first
digit (5 + 1), I didn't find a reference to.  I also am not sure that
changing the depth to 2 would make this effective for SNMPv3 packets,
however I couldn't find where everything is supposed to be in an
SNMPv3 packet.

Anyhow, that's my two cents.  :)

Mark

On Fri, 15 Oct 2004 13:56:07 -0400, Matt Kettler <mkettler@xxxxxxxxxxx> wrote:
> At 04:01 AM 10/14/2004, Koelewijn, Bert wrote:
> >Dear snort sigs team,
> >
> >SID:1893 SNMP missing community string attempt
> >
> >This rule has a false positive with the attached packet. The rule triggers
> >on the SNMP request id.
> 
> Hmm, that's quite odd. The rule should avoid hitting that packet with the
> depth and offset keywords.
> 
> What snort version are you using? 2.2.0?
> What rev of 1893 are you using? (although as far as I can tell, even rev 1
> has the depth/offset, and rev4 is the latest, it's helpful to know for sure
> what rule you're using).
> 
> 
> >Please keep the information in the attachment confidential.
> 
> That will be difficult.. This is a public mailing list.
> 
> However, for what it's worth, I'll avoid disclosing any of the information
> in the packet.
> 
> -------------------------------------------------------
> This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
> Use IT products in your business? Tell us what you think of them. Give us
> Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
> http://productguide.itmanagersjournal.com/guidepromo.tmpl
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs@xxxxxxxxxxxxxxxxxxxxx
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
> 


-- 
Mark Buchanan


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl