Prioritization of the local rules against the default one.

dom via Snort-sigs <[email protected]> Thu, 21 Mar 2024 09:05:51 +0000
Newsgroups gmane.comp.security.ids.snort.sigs
Message-ID <[email protected]>
Override basic rules.
I have got snort version:3+ runs on my system. If works fine and classy, 
however I have a small configuration problem.
One of the local music streaming device attached to the local network. 
When is on it jeopardize the all local system, by regular sending tons 
of discovery request following form:
/...
192.168.1.170:3483 -> 255.255.255.255:3483
.../
As you can expect, it triggers snort responds on the udp filter and 
block the device for about a minute, and then come back, until starts 
again let's call it "udp flood", and the scenario repeat itself.
I have created folioing rule to ignore it.
*...
pass udp 192.168.1.170 3483 <> 192.168.1.0/24 3483 (priority:1; 
sid:1000077; rev:1;)
...*
Snort likes it  (the rule), however it is still bloked, snort log below:
/...
[**] [116:414:1] "(ipv4) IPv4 packet to broadcast dest address" [**]
[Priority: 3]
03/20-21:22:07.757460 192.168.1.170:3483 -> 255.255.255.255:3483
UDP TTL:64 TOS:0x0 ID:14225 IpLen:20 DgmLen:46
Len: 18
.../
I am sure there is a way to prioritize the local traffic against the 
basic snort rules. I am diving through the snort 2.9 documentation, but 
it is a large one, and it takes some time.
Is there anyone who could point out the right direction how to solve 
thee problem.
Regards
dom

_______________________________________________
Snort-sigs mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a href=" https://snort.org/downloads/#rule-downloads">emerging threats</a>!
OpenPGP_0x0EEEBE85AABC7033.asc (application/pgp-keys, 3.8 KB)
-----BEGIN PGP PUBLIC KEY BLOCK-----

xsFNBGHA3jgBEADEvGqMkGY0W570RiURIBnruhJFDy65wsJewW1mF+ul/jlgNbsK
hZXTx3D2OWwAU5uMsPrXFuGn43GDGZc7K19134ka4b/PuX02ZFwiXG6czgXifUiZ
U5RjQyBkqRuCqh7nZVviDf82zKvQQ42O/vqmmVypUa5lVMPmh1C29Yfec5T34Shq
GyiUgfOQaJEO1xzObGyL5S60OTJN225kbOeCdAb7XdQGz3XkH5baGHiGwRXFY0TG
yoYmzIzVoqVQzTxI85condCDMfmA9ntLgMVudaaYQouxAONq1/KGLAr2bvy20LUX
NoE+zwyrnkBzmhhHEUXsazrvfQPcClvpXLgxcyUs/FXsl2uIK3VKWgIlisYoUC42
Nb28aFtj5GwMxdGbym8NxPlgH1V0FxbiJCTvkGttTte0W/8L3m91n1JHbp+eTQx6
YbXRXOTTxwjcsnCgo9Of7OjxuH4dcv5EmgMEqD2xH3b6t4TnT9KwTkKVhDAcyIZ8
coz+KLJ2YaLfSU3q8YHKYtn9HbV5+JnmPqrqhpDg3nMOP1t0IjEsydUdLGORkmr3
Gma5S6n9V9oD5vZo2C3QXFlrO2Wp/7mEv9Sq3r3nUWpHDiDRsrQbqZ3PVaZ9zQfq
lZke7MCc8eGDngqaIT2lwSq4CZrJxDldWrIZD3vYzqIn0+n3cK5TJ7Z/SQARAQAB
zRlEb21pbmlrIEQgPGRAd2Vkb3QuY28udWs+wsGUBBMBCgA+FiEEuxQrvFU2pVXy
ogWuDu6+haq8cDMFAmHA3jgCGy8FCQlmAYAFCwkIBwIGFQoJCAsCBBYCAwECHgEC
F4AACgkQDu6+haq8cDPCaw//b2rjTXUUGgdqiXYcvc3iyPHlswkDOlf1DJusFHB7
/29Af/1fCB0obIyCJzovh02ZA9PMEh9dK6umnLG7vmtX2ebjuObCY/WLn5ZhxA1Q
A5p7KKx+hEC7A/CMgN+0DPsztJH5U5jzGngpMWlhbJ9yDLwghUJNx9l4qsenIPw1
U+DWiPwVUpx89xZtjtaQ0hWjmuQwmf8XT/Itp2rFI7iJ8VHEOGufcgGVfg1kC4Ot
kIfGBmSv8bTMDkdueAHMNwIJN6czh1+KdO4YIGVmVCJLFJEA5xQTyZzcYhQ2kiIl
hHEwH7DYSO32XG8EHivxHILa15xePpjAHM4ZHhpgxFaLXlZtd6H4EVGINscHOVTt
a9kRvDcVyV2siW50dAL1z0/ZuubNvdYhR1TkJr+DKuvJPNCVT03P9k353lrO52FZ
FA+OTZholtoZTgF57M3+GgIS3i5f5EU4AEDoXkxJ3OzqDQR6SBbdYlrWYIs0znyh
Hd9tpJZH/Fj0ECOvYlYywq1fnrCHwXzM7WQS/gcwgBLoi6WlZCsM+wSzVUlRnKHu
f6vi70T+H8itSumcVTxpGOB+6/IABecLCjVAgE3XRkPujymjf5edqAZTwMrAIdDU
6A2dg51pUednQBGy84o2911xNnD5Tl3lMTh4wE8sx9vrkgnSQrLbzcZorMzYqE/5
GNvOwU0EYcDeOAEQANROeFe/ubFodmWKlF6pX2vBf6uu4/Jw5XFH/SpESRL1RKED
SHhpYHeR3NCvaWny3K6vCiydQ3jwUa8QqC5EInxxo0db9POgyYIvqcGgFT8Hs/3A
uijBTQxhpkj3/phnPVROXsZcAQikqRh+lUHdx6KNud5PC/SELENzYTdxRsG8JgW/
6/mObdVA226bLuSlN9MlKY61r3GOxwLlSMM5TJrQIFS6wrRV4lZfVkDOAa/KfWGg
t9i//ADDLjzqIDNbyt/cCp5ARDjUX1JNQuNa2TgRQIWXsVxMYZeXRf1g04ykdqKp
XnZGJHGdMEZ0eyEjH5Skm3WI7ntZtdlx4Qx6uvPkp3mnqjqT13o5uZMWWFz93toB
RNzM6KpZvI20c4xvDqpSQBk7hAv7OqCglXwHqJ6zTmvl06FJrQ5/IvlFudujibv+
2eqwgp1UJd2Fm11xa+UaUdL9DJ9yTT1LsZAOSkdZYq5ADmzvHRwWLLyE/+O5d6KW
lFyjOGMIeTgRzYmx561kbtv/5c2TBubxoMCXe67QqvVnUMgLiRrF9Lo5+KhrzTXA
7qSbXmdygCdOcKi+r42EiU5l+yrDw3EkVMeoAYHISpE2AHLl2TduqfmyvgyVRrLC
HM1SXyZarNG+slVXuTirfRk29dmduMZOqjBRVPyoCKUcU70KZttItEMif0ljABEB
AAHCw7IEGAEKACYWIQS7FCu8VTalVfKiBa4O7r6FqrxwMwUCYcDeOAIbLgUJCWYB
gAJACRAO7r6FqrxwM8F0IAQZAQoAHRYhBPqHqB4hTO3Fe9ChZdAn2NLssracBQJh
wN44AAoJENAn2NLssracaxsQAMLivoE6Gx6Ku5OeN7zgEwqV9GHdygqJWGUB5lbK
eoqPqitoyLSzjB6hQtqil1UMSuFCRg+7kOKWuKYJEKiAijPxHSSNVJ2wP22Erjyf
0un5tTHTFQyOkHSY9wLpzF4LfJPhEVdMxF3xGdKB5J4WJQUDlJKh0d0lWtF2CgWj
dQXA6r0zfV93jbYahOl6Z0s/EIVepbzUPAcbwtx0UK5D/U58OgLa5gBfQP+qFF9b
oGxPvccOx2FGCZ0rbOfwSmb1NfaOT5gjo4IU7E1Ioe1QJ9tURR2DQjpzJ6TT/RrJ
MHIsQ2Hm73cBSxUTUQbpz4cp4ooPNPwuQ+EUyD5KH4clxHEhJbq3LnHGGlcT2Lns
P1xf3mrRONVQPv3QaHqEzMUVt3cHVT50AL8j01U2sw6340M6ndR+xtcRfACGqH2p
Y4TPaiYcvy86FkhSIEnJdLQkxAD/WoeRDgFWrn1uiWIb32E2r3+sPYr56QxnrVdI
DL9iMjO0jGsLu7ozEO52X7R8+dAUCKzBWrzMiT6aYhDeWqX2NGTIjOAqL818d+BT
X4gZTjPMudsmvww+MOemWMbfmBjK/Ke7FLFs5EpzgAIHlpXXWqStwFMljv83lSDA
/PVOt/6stSTbEVbpab7ZrPQ8pcXaKt1dEKKoDyVMAy6SoyX0dxmeGS18CC5SNn/s
LosTBxoP/RuZz3nL9jH8WtZRbOSv3dUZshm6hQ1vKpxXsOP3pnFWDfpVqxAmR7yG
9JY1PP2fFv0wVcwWTE8fGWdieEmmBJFnnONTWdMdXmrl83j1krmID9SsxXBQ2PXv
oi/UthwFFFdEbVd2L+7yZNSh23OGtjLNZ7khtrQQUaFd5Qs/x3SqVL6/zVwP6iIA
1j4+8eEBeVFhU4C7x13ylwcQpSyU0dpUS5QLJmq1nKFPq/2nyH341n5Qy1QuLnsv
HVXQ5/8afCDjBohcOFFyJc06nxQF5u1US2AamAk1iozzjOHsuXE7mT0DGZl2E8qv
EO/L4ysFC+N/UBaALFQgWT55QFNG2rWbu4LvVoeuComjhS7x33rzeI3ORW8Qg3Yd
J2RypV/2rOVfCdqqVKJz7gN/zO1WeeubrbtlWpN2VMv1VyxhClOl/zQulccvfpCJ
G0etEvnO7MJwQGujRTqXYnOMzqdsKjRNrGIOv7noVphRLh5M4Ioz9PpEbKJdJ+5v
erGEcxM+6+m4DgExRfwvX0e9qWQK8AcFYKI4LoHZqcw/jN8AP6EXePeFADDa3X3t
g4R1xNl4SFxnY9xqLGebFUJS58H5SOSj7/km5OEgi46soIoXwStCBAl/2wYkqBNo
P/fslaRro7Bxsc+2eCL3T3Y+ICiyIAocqbl3j/9aV7+SMbn0VPVx
=MMsY
-----END PGP PUBLIC KEY BLOCK-----
OpenPGP_signature.asc (application/pgp-signature, 840 B)
-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEE+oeoHiFM7cV70KFl0CfY0uyytpwFAmX7+HAFAwAAAAAACgkQ0CfY0uyytpz5
DxAAj3Ijt304RqYALcCWRRZlB82wgjghYiH/We853ltH93Vlp+RYUPoCo84zA7xOrUTJgdRJ74cO
8TD28YnjhhSBdtJEo/fHHyCui+U+tAZF43tuQgIFklwZU4BxkiT+/llMHDGXOlGhdFGTxaAvpqD9
k64G5u6wTmkFzdII+ezTCFDjJY0rZAJX6O8jkVeOzCIOKvOxPlcn9Pdvw60pxgsXyhrcDSkcyGzn
VI5fgJD9/Qm0WjEyLjBpiOqHEJzy1UgQIqz+09fs61pGDLXOrgCLxsqbwc+l2nx4MJgUA/Hrfx9H
mti7BZ2Men2b6kfVuNOqugizaJQKKdJV7KUw+8GcqLN2EKqnpTQeOPFxxsvkleTCfhRS2OURri0k
SN6XXmMKX5pF49uDxDXd9jf4tgNn0m4DyZcbwXWa3qQ+l4QdUScZ65pYu51PiD6tLeQmtznmtaws
zlrNbuK9d2x2iKQGI0zc9jQLxeTM0xxmI5SZ24o+O2aD/xbF7JWL9tK3dyb9bVit4Rpn1UWPIqNC
DHOXUYiFw0RE6U6P6mvrZOoLKRYnOOrk8z4gdGoDlQcdbIjEmiYpW9hgjMZdhXyew0RPVhqjXIP5
Z5vLhiLRnwU6SeiG2F14tFN9/sEAoig3d3OtFR4bDyZpU33l0zBpd2/x8BdzGd687bBsAVLzwkgA
+i0=
=WiqE
-----END PGP SIGNATURE-----