LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 12-11-2008, 05:12 PM   #1
ogoy
LQ Newbie
 
Registered: Mar 2007
Posts: 9

Rep: Reputation: 0
Typographical error in my snort report for FTP IDS.


Hello everyone, I recently jumped into the snort bandwagon, and was left with several issues to resolve. One of them is that snort reports the ff:

"Binary data being sent to communitcation FTP port."

When it should read:

"Binary data being sent to communication FTP port."

I don't know how the "t" got in there, and I need help on how to fix the typo.

Thanks very much!

Ogoy
 
Old 12-11-2008, 05:57 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
I can't match that string to any of the Snort .*.rules file contents? What are you running exactly?
 
Old 12-11-2008, 06:35 PM   #3
ogoy
LQ Newbie
 
Registered: Mar 2007
Posts: 9

Original Poster
Rep: Reputation: 0
Hi unSpawn,

Here's my version:

,,_ -*> Snort! <*-
o" )~ Version 2.4.3 (Build 26) i386
'''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html
(C) Copyright 1998-2005 Sourcefire Inc., et al.
NOTE: Snort's default output has changed in version 2.4.1!
The default logging mode is now PCAP, use "-K ascii" to activate
the old default logging mode.
 
Old 12-12-2008, 01:03 PM   #4
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
Could you please search for that string in the Snort .*.rules files?
 
Old 12-12-2008, 11:48 PM   #5
ogoy
LQ Newbie
 
Registered: Mar 2007
Posts: 9

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by unSpawn View Post
Could you please search for that string in the Snort .*.rules files?
[mine@linux root]# grep -i ftp /etc/snort/*.rules*
[mine@linux root]# grep -i comm /etc/snort/*.rules*

[mine@root root]# ls -lotr /etc/snort/
total 224
-rw-r--r-- 1 root 53841 Oct 20 2003 unicode.map
-rw-rw-r-- 1 root 1567 Dec 3 09:04 vrt.rules.good
-rw-rw-r-- 1 root 83865 Dec 3 09:04 snort.conf.good
-rw-rw-r-- 1 root 1567 Dec 13 13:14 vrt.rules
-rw-rw-r-- 1 root 83882 Dec 13 13:14 snort.conf

nothing there. btw im running:

Linux version 2.4.21-zoobah.34smp (zoobah@mine.com) (gcc version 3.2.3 20030502 (Red Hat Linux 3.2.3-34)) #1 SMP Tue Jul 22 22:01:23 MDT 2008
 
Old 12-13-2008, 07:50 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594Reputation: 3594
OK, please tell us where you actually encounter the "Binary data being sent to communitcation FTP port." message in? Is it some form of reporting or front-end?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Report: Snort: IDS Done Well (and Good) LXer Syndicated Linux News 0 07-02-2007 07:46 PM
How to setup snort IDS saini_mw Linux - Security 2 05-15-2006 07:46 AM
developing an ids using snort chax Linux - Security 1 01-10-2006 12:20 PM
Snort/ACID as an IDS WeNdeL Linux - Security 4 09-10-2004 12:14 PM
snort (ids) not working please help!!! crealkillerI75 Slackware 5 07-18-2002 03:39 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 02:01 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration