|
|
|
|
Snort Forums Archive
Archive Home » Windows » Cannot get eDonkey rule to fire
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
Cannot get eDonkey rule to fire
Posted by daffy_69 on March 15, 2006 07:44:29
Hello all,
I am using Snort in conjunction with snortsam on an WinXP box to control P2P on a network.
I use the command line :
snort -l c:\snort\log -c c:\snort\etc\snort.conf -i 2
the p2p.rules is included in the snort.conf file
snortsam blocks other protocols (namely gnutella, and bittorrent are the ones that are getting blocked) so I know that at least the setup is working, I just wonder why it's not firing rule 2586 or 2587. I can see the traffic with Ethereal.
i have the rules as:
alert tcp $HOME_NET any -> $EXTERNAL_NET 4242 (msg:"P2P eDonkey transfer"; flow:to_server,established; content:"|E3|"; depth:1; reference:url,www.kom.e-technik.tu-darmstadt.de/publications/abstracts/HB02-1.html; classtype:policy-violation; sid:2586; rev:2;fwsam: dst, 5 minutes;)
alert tcp $HOME_NET 4711 -> $EXTERNAL_NET any (msg:"P2P eDonkey server response"; flow:established,from_server; content:"Server|3A| eMule"; reference:url,www.emule-project.net; classtype:policy-violation; sid:2587; rev:2;fwsam: dst, 5 minutes;)
maybe I have a typo in there that I just can't see, but any help would be appreciated.
this is rule 556, which fires correctly:
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P Outbound GNUTella client request"; flow:to_server,established; content:"GNUTELLA CONNECT"; depth:40; classtype:policy-violation; sid:556; rev:5;fwsam: dst, 5 minutes;)
Thanks |
|
Posted by malaci81 on September 07, 2006 02:28:07
Hi
Looking at your first rule it is set for tcp all the stuff i have been getting back is udp. Also eDonkey uses lots of port numbers not just 4242.
I have been using this rule to catch them on our network as thay keep swapping port numbers in an effort to get past us.
alert udp any 2000:10000 -> any 2000:10000 (content:"|e3 11|"; offset:0; depth:2; msg:"eDonkey download offer"; classtype:successful-recon-limited; sid:1000006; rev:3;)
Gary |
|
Posted by malaci81 on September 07, 2006 03:44:14
Hi
Looking at your first rule it is set for tcp all the stuff i have been getting back is udp. Also eDonkey uses lots of port numbers not just 4242.
I have been using this rule to catch them on our network as thay keep swapping port numbers in an effort to get past us.
alert udp any 2000:10000 -> any 2000:10000 (content:"|e3 11|"; offset:0; depth:2; msg:"eDonkey download offer"; classtype:successful-recon-limited; sid:1000006; rev:3;)
Gary |
|
|
|
|
|
