Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
[Snort-users] Syntax error in NSM
30 views
Skip to first unread message
elmo second
May 10, 2013, 7:30:20 AM5/10/13
to
I understand there is an issue importing Snort rules into McAfee NSM.
I am trying to import a rule to alert for FTP anonymous:
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY-OTHER FTP anonymous login attempt"; flow:to_server,established; content:"USER"; fast_pattern:only; pcre:"/^USER\s+(anonymous|ftp)[^\w]*[\r\n]/smi"; metadata:ruleset community, service ftp; classtype:misc-activity; sid:553; rev:13; )
I am receiving a syntax error.
Any assistance appreciated.
Elmo
I am trying to import a rule to alert for FTP anonymous:
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY-OTHER FTP anonymous login attempt"; flow:to_server,established; content:"USER"; fast_pattern:only; pcre:"/^USER\s+(anonymous|ftp)[^\w]*[\r\n]/smi"; metadata:ruleset community, service ftp; classtype:misc-activity; sid:553; rev:13; )
I am receiving a syntax error.
Any assistance appreciated.
Elmo
Joel Esler
May 15, 2013, 9:12:07 PM5/15/13
to
Elmo,
I suggest you contact Mcafee support for help with a Mcafee product. The Snort user group is not the place to ask for help with that.
--
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
Joel Esler
Senior Research Engineer, VRT
OpenSource Community Manager
Sourcefire
waldo kitty
May 15, 2013, 9:58:40 PM5/15/13
to
On 5/10/2013 07:30, elmo second wrote:
> I understand there is an issue importing Snort rules into McAfee NSM.
>
> I am trying to import a rule to alert for FTP anonymous:
>
> alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY-OTHER FTP anonymous
> login attempt"; flow:to_server,established; content:"USER"; fast_pattern:only;
> pcre:"/^USER\s+(anonymous|ftp)[^\w]*[\r\n]/smi"; metadata:ruleset community,
> service ftp; classtype:misc-activity; sid:553; rev:13; )
>
> I am receiving a syntax error.
> Any assistance appreciated.
what is the supposed "syntax" error? without that, all anyone can do is make
> I understand there is an issue importing Snort rules into McAfee NSM.
>
> I am trying to import a rule to alert for FTP anonymous:
>
> alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"POLICY-OTHER FTP anonymous
> login attempt"; flow:to_server,established; content:"USER"; fast_pattern:only;
> pcre:"/^USER\s+(anonymous|ftp)[^\w]*[\r\n]/smi"; metadata:ruleset community,
> service ftp; classtype:misc-activity; sid:553; rev:13; )
>
> I am receiving a syntax error.
> Any assistance appreciated.
WAGs... at best they might be eWAGs...
WAG == Wild Arsed Guess
eWAG == educated WAG
--
NOTE: No off-list assistance is given without prior approval.
Please keep mailing list traffic on the list unless
private contact is specifically requested and granted.
------------------------------------------------------------------------------
AlienVault Unified Security Management (USM) platform delivers complete
security visibility with the essential security capabilities. Easily and
efficiently configure, manage, and operate all of your security controls
from a single console and one unified framework. Download a free trial.
http://p.sf.net/sfu/alienvault_d2d
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
Please visit http://blog.snort.org to stay current on all the latest Snort news!
Wei Chea Ang
May 15, 2013, 11:59:11 PM5/15/13
to
I have experienced with nsm where some of the rule options are not being recognised.
0 new messages