Prioritization of the local rules against the default one.
dom via Snort-sigs <[email protected]> Thu, 21 Mar 2024 09:05:51 +0000
| Newsgroups | gmane.comp.security.ids.snort.sigs |
|---|---|
| Message-ID | <[email protected]> |
Override basic rules. I have got snort version:3+ runs on my system. If works fine and classy, however I have a small configuration problem. One of the local music streaming device attached to the local network. When is on it jeopardize the all local system, by regular sending tons of discovery request following form: /... 192.168.1.170:3483 -> 255.255.255.255:3483 .../ As you can expect, it triggers snort responds on the udp filter and block the device for about a minute, and then come back, until starts again let's call it "udp flood", and the scenario repeat itself. I have created folioing rule to ignore it. *... pass udp 192.168.1.170 3483 <> 192.168.1.0/24 3483 (priority:1; sid:1000077; rev:1;) ...* Snort likes it (the rule), however it is still bloked, snort log below: /... [**] [116:414:1] "(ipv4) IPv4 packet to broadcast dest address" [**] [Priority: 3] 03/20-21:22:07.757460 192.168.1.170:3483 -> 255.255.255.255:3483 UDP TTL:64 TOS:0x0 ID:14225 IpLen:20 DgmLen:46 Len: 18 .../ I am sure there is a way to prioritize the local traffic against the basic snort rules. I am diving through the snort 2.9 documentation, but it is a large one, and it takes some time. Is there anyone who could point out the right direction how to solve thee problem. Regards dom _______________________________________________ Snort-sigs mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-sigs Please visit http://blog.snort.org for the latest news about Snort! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
OpenPGP_0x0EEEBE85AABC7033.asc
(application/pgp-keys, 3.8 KB)
-----BEGIN PGP PUBLIC KEY BLOCK----- xsFNBGHA3jgBEADEvGqMkGY0W570RiURIBnruhJFDy65wsJewW1mF+ul/jlgNbsK hZXTx3D2OWwAU5uMsPrXFuGn43GDGZc7K19134ka4b/PuX02ZFwiXG6czgXifUiZ U5RjQyBkqRuCqh7nZVviDf82zKvQQ42O/vqmmVypUa5lVMPmh1C29Yfec5T34Shq GyiUgfOQaJEO1xzObGyL5S60OTJN225kbOeCdAb7XdQGz3XkH5baGHiGwRXFY0TG yoYmzIzVoqVQzTxI85condCDMfmA9ntLgMVudaaYQouxAONq1/KGLAr2bvy20LUX NoE+zwyrnkBzmhhHEUXsazrvfQPcClvpXLgxcyUs/FXsl2uIK3VKWgIlisYoUC42 Nb28aFtj5GwMxdGbym8NxPlgH1V0FxbiJCTvkGttTte0W/8L3m91n1JHbp+eTQx6 YbXRXOTTxwjcsnCgo9Of7OjxuH4dcv5EmgMEqD2xH3b6t4TnT9KwTkKVhDAcyIZ8 coz+KLJ2YaLfSU3q8YHKYtn9HbV5+JnmPqrqhpDg3nMOP1t0IjEsydUdLGORkmr3 Gma5S6n9V9oD5vZo2C3QXFlrO2Wp/7mEv9Sq3r3nUWpHDiDRsrQbqZ3PVaZ9zQfq lZke7MCc8eGDngqaIT2lwSq4CZrJxDldWrIZD3vYzqIn0+n3cK5TJ7Z/SQARAQAB zRlEb21pbmlrIEQgPGRAd2Vkb3QuY28udWs+wsGUBBMBCgA+FiEEuxQrvFU2pVXy ogWuDu6+haq8cDMFAmHA3jgCGy8FCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwECHgEC F4AACgkQDu6+haq8cDPCaw//b2rjTXUUGgdqiXYcvc3iyPHlswkDOlf1DJusFHB7 /29Af/1fCB0obIyCJzovh02ZA9PMEh9dK6umnLG7vmtX2ebjuObCY/WLn5ZhxA1Q A5p7KKx+hEC7A/CMgN+0DPsztJH5U5jzGngpMWlhbJ9yDLwghUJNx9l4qsenIPw1 U+DWiPwVUpx89xZtjtaQ0hWjmuQwmf8XT/Itp2rFI7iJ8VHEOGufcgGVfg1kC4Ot kIfGBmSv8bTMDkdueAHMNwIJN6czh1+KdO4YIGVmVCJLFJEA5xQTyZzcYhQ2kiIl hHEwH7DYSO32XG8EHivxHILa15xePpjAHM4ZHhpgxFaLXlZtd6H4EVGINscHOVTt a9kRvDcVyV2siW50dAL1z0/ZuubNvdYhR1TkJr+DKuvJPNCVT03P9k353lrO52FZ FA+OTZholtoZTgF57M3+GgIS3i5f5EU4AEDoXkxJ3OzqDQR6SBbdYlrWYIs0znyh Hd9tpJZH/Fj0ECOvYlYywq1fnrCHwXzM7WQS/gcwgBLoi6WlZCsM+wSzVUlRnKHu f6vi70T+H8itSumcVTxpGOB+6/IABecLCjVAgE3XRkPujymjf5edqAZTwMrAIdDU 6A2dg51pUednQBGy84o2911xNnD5Tl3lMTh4wE8sx9vrkgnSQrLbzcZorMzYqE/5 GNvOwU0EYcDeOAEQANROeFe/ubFodmWKlF6pX2vBf6uu4/Jw5XFH/SpESRL1RKED SHhpYHeR3NCvaWny3K6vCiydQ3jwUa8QqC5EInxxo0db9POgyYIvqcGgFT8Hs/3A uijBTQxhpkj3/phnPVROXsZcAQikqRh+lUHdx6KNud5PC/SELENzYTdxRsG8JgW/ 6/mObdVA226bLuSlN9MlKY61r3GOxwLlSMM5TJrQIFS6wrRV4lZfVkDOAa/KfWGg t9i//ADDLjzqIDNbyt/cCp5ARDjUX1JNQuNa2TgRQIWXsVxMYZeXRf1g04ykdqKp XnZGJHGdMEZ0eyEjH5Skm3WI7ntZtdlx4Qx6uvPkp3mnqjqT13o5uZMWWFz93toB RNzM6KpZvI20c4xvDqpSQBk7hAv7OqCglXwHqJ6zTmvl06FJrQ5/IvlFudujibv+ 2eqwgp1UJd2Fm11xa+UaUdL9DJ9yTT1LsZAOSkdZYq5ADmzvHRwWLLyE/+O5d6KW lFyjOGMIeTgRzYmx561kbtv/5c2TBubxoMCXe67QqvVnUMgLiRrF9Lo5+KhrzTXA 7qSbXmdygCdOcKi+r42EiU5l+yrDw3EkVMeoAYHISpE2AHLl2TduqfmyvgyVRrLC HM1SXyZarNG+slVXuTirfRk29dmduMZOqjBRVPyoCKUcU70KZttItEMif0ljABEB AAHCw7IEGAEKACYWIQS7FCu8VTalVfKiBa4O7r6FqrxwMwUCYcDeOAIbLgUJCWYB gAJACRAO7r6FqrxwM8F0IAQZAQoAHRYhBPqHqB4hTO3Fe9ChZdAn2NLssracBQJh wN44AAoJENAn2NLssracaxsQAMLivoE6Gx6Ku5OeN7zgEwqV9GHdygqJWGUB5lbK eoqPqitoyLSzjB6hQtqil1UMSuFCRg+7kOKWuKYJEKiAijPxHSSNVJ2wP22Erjyf 0un5tTHTFQyOkHSY9wLpzF4LfJPhEVdMxF3xGdKB5J4WJQUDlJKh0d0lWtF2CgWj dQXA6r0zfV93jbYahOl6Z0s/EIVepbzUPAcbwtx0UK5D/U58OgLa5gBfQP+qFF9b oGxPvccOx2FGCZ0rbOfwSmb1NfaOT5gjo4IU7E1Ioe1QJ9tURR2DQjpzJ6TT/RrJ MHIsQ2Hm73cBSxUTUQbpz4cp4ooPNPwuQ+EUyD5KH4clxHEhJbq3LnHGGlcT2Lns P1xf3mrRONVQPv3QaHqEzMUVt3cHVT50AL8j01U2sw6340M6ndR+xtcRfACGqH2p Y4TPaiYcvy86FkhSIEnJdLQkxAD/WoeRDgFWrn1uiWIb32E2r3+sPYr56QxnrVdI DL9iMjO0jGsLu7ozEO52X7R8+dAUCKzBWrzMiT6aYhDeWqX2NGTIjOAqL818d+BT X4gZTjPMudsmvww+MOemWMbfmBjK/Ke7FLFs5EpzgAIHlpXXWqStwFMljv83lSDA /PVOt/6stSTbEVbpab7ZrPQ8pcXaKt1dEKKoDyVMAy6SoyX0dxmeGS18CC5SNn/s LosTBxoP/RuZz3nL9jH8WtZRbOSv3dUZshm6hQ1vKpxXsOP3pnFWDfpVqxAmR7yG 9JY1PP2fFv0wVcwWTE8fGWdieEmmBJFnnONTWdMdXmrl83j1krmID9SsxXBQ2PXv oi/UthwFFFdEbVd2L+7yZNSh23OGtjLNZ7khtrQQUaFd5Qs/x3SqVL6/zVwP6iIA 1j4+8eEBeVFhU4C7x13ylwcQpSyU0dpUS5QLJmq1nKFPq/2nyH341n5Qy1QuLnsv HVXQ5/8afCDjBohcOFFyJc06nxQF5u1US2AamAk1iozzjOHsuXE7mT0DGZl2E8qv EO/L4ysFC+N/UBaALFQgWT55QFNG2rWbu4LvVoeuComjhS7x33rzeI3ORW8Qg3Yd J2RypV/2rOVfCdqqVKJz7gN/zO1WeeubrbtlWpN2VMv1VyxhClOl/zQulccvfpCJ G0etEvnO7MJwQGujRTqXYnOMzqdsKjRNrGIOv7noVphRLh5M4Ioz9PpEbKJdJ+5v erGEcxM+6+m4DgExRfwvX0e9qWQK8AcFYKI4LoHZqcw/jN8AP6EXePeFADDa3X3t g4R1xNl4SFxnY9xqLGebFUJS58H5SOSj7/km5OEgi46soIoXwStCBAl/2wYkqBNo P/fslaRro7Bxsc+2eCL3T3Y+ICiyIAocqbl3j/9aV7+SMbn0VPVx =MMsY -----END PGP PUBLIC KEY BLOCK-----
OpenPGP_signature.asc
(application/pgp-signature, 840 B)
-----BEGIN PGP SIGNATURE----- wsF5BAABCAAjFiEE+oeoHiFM7cV70KFl0CfY0uyytpwFAmX7+HAFAwAAAAAACgkQ0CfY0uyytpz5 DxAAj3Ijt304RqYALcCWRRZlB82wgjghYiH/We853ltH93Vlp+RYUPoCo84zA7xOrUTJgdRJ74cO 8TD28YnjhhSBdtJEo/fHHyCui+U+tAZF43tuQgIFklwZU4BxkiT+/llMHDGXOlGhdFGTxaAvpqD9 k64G5u6wTmkFzdII+ezTCFDjJY0rZAJX6O8jkVeOzCIOKvOxPlcn9Pdvw60pxgsXyhrcDSkcyGzn VI5fgJD9/Qm0WjEyLjBpiOqHEJzy1UgQIqz+09fs61pGDLXOrgCLxsqbwc+l2nx4MJgUA/Hrfx9H mti7BZ2Men2b6kfVuNOqugizaJQKKdJV7KUw+8GcqLN2EKqnpTQeOPFxxsvkleTCfhRS2OURri0k SN6XXmMKX5pF49uDxDXd9jf4tgNn0m4DyZcbwXWa3qQ+l4QdUScZ65pYu51PiD6tLeQmtznmtaws zlrNbuK9d2x2iKQGI0zc9jQLxeTM0xxmI5SZ24o+O2aD/xbF7JWL9tK3dyb9bVit4Rpn1UWPIqNC DHOXUYiFw0RE6U6P6mvrZOoLKRYnOOrk8z4gdGoDlQcdbIjEmiYpW9hgjMZdhXyew0RPVhqjXIP5 Z5vLhiLRnwU6SeiG2F14tFN9/sEAoig3d3OtFR4bDyZpU33l0zBpd2/x8BdzGd687bBsAVLzwkgA +i0= =WiqE -----END PGP SIGNATURE-----