作者 主題: snort 重組  (閱讀 4328 次)

0 會員 與 1 訪客 正在閱讀本文。

mmslm

  • 可愛的小學生
  • *
  • 文章數: 1
    • 檢視個人資料
snort 重組
« 於: 2010-05-17 11:37 »
我看了snort的官方文檔,它說snort是支持ip重組的

可是爲什麽 我一個大於1500的包 觸發了我編寫的規則,就只接收到了前面小於1500的內容 後面的就全部沒掉了 這個是爲什麽呢?
哪裡需要設置嗎?

我的規則如下

alert tcp $EXTERNAL_NET any -> $SQL_SERVERS any (msg:"ORACLE test"; flow:to_server,established; content:"STEST"; nocase; classtype:protocol-command-decode; sid:1680; rev:5;)


我發包的內容如下:
stest  = ('013D0000060400000000116B050C0000000D00000001000000035E066180000000000000B03F420798000000C8B1C6060D00000000000000FCB1C606000000000000000000000000000000000000000000000000000000000000000000000000FEB1C6066841420700000000FE4073656C656374206F626A6563745F6E616D652C206F626A6563745F747970650A66726F6D207379732E757365725F6F626A65637473206F0A7768657265206F2E406F626A6563745F7479706520696E2028275441424C45272C202756494557272C20275041434B414745272C2754595045272C202750524F434544555245272C20182746554E4354494F4E272C202753455155454E434527290A0001000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000013D0000060400000000116B050C0000000D00000001000000035E066180000000000000B03F420798000000C8B1C6060D00000000000000FCB1C606000000000000000000000000000000000000000000000000000000000000000000000000FEB1C6066841420700000000FE4073656C656374206F626A6563745F6E616D652C206F626A6563745F747970650A66726F6D207379732E757365725F6F626A65637473206F0A7768657265206F2E406F626A6563745F7479706520696E2028275441424C45272C202756494557272C20275041434B414745272C2754595045272C202750524F434544555245272C20182746554E4354494F4E272C202753455155454E434527290A000100000000000000000000000000000000000000000000000000000005CB0000060400000000116916C481C5060100000001000000035E172180000000000000BC7BC50614050000285643070D000000000000005C5643070000000000000000000000000000000000000000000000000000000000000000000000005E564307F081C50600000000FE40696E7365727420696E746F2073746573742076616C7565732028312C273031334430303030303630343030303030303030313136423035304330303030303030404430303030303030313030303030303033354530363631383030303030303030303030303042303346343230373938303030303030433842314336303630443040303030303030303030303030304643423143363036303030303030303030303030303030303030303030303030303030303030303030303030303030303030304030303030303030303030303030303030303030303030303030303030304645423143363036363834313432303730303030303030304645343037333635364336403536333734323036463632364136353633373435463645363136443635324332303646363236413635363337343546373437393730363530413636373236463640443230373337393733324537353733363537323546364636323641363536333734373332303646304137373638363537323635323036463245343036463632364041363536333734354637343739373036353230363936453230323832373534343134323443343532373243323032373536343934353537323732433230323735403034313433344234313437343532373243323735343539353034353237324332303237353035323446343334353434353535323435323732433230313832373440363535344534333534343934463445323732433230323735333435353135353435344534333435323732393041303030313030303030303030303030303030304030303030303030303030303030303030303030303030303030303030303030303030303030303030313030303030303030303030303030303030303030303030403030303030303030303030303030303030303030303030303133443030303030363034303030303030303031313642303530433030303030303044303030303040303031303030303030303335453036363138303030303030303030303030304230334634323037393830303030303043384231433630363044303030303030304030303030303030464342314336303630303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030303030403030303030303030303030303030303030303030303030464542314336303636383431343230373030303030303030464534303733363536433635363337343240303646363236413635363337343546364536313644363532433230364636323641363536333734354637343739373036353041363637323646364432303733374039373332453735373336353732354636463632364136353633373437333230364630413737363836353732363532303646324534303646363236413635363337403435463734373937303635323036393645323032383237353434313432344334353237324332303237353634393435353732373243323032373530343134333440423431343734353237324332373534353935303435323732433230323735303532344634333435343435353532343532373243323031383237343635353445344033353434393446344532373243323032373533343535313535343534453433343532373239304130303031303030303030303030303030303030303030303030403030303030303030303030303030303030303030303030303030303030303030303031303030303030303030303030303030303030303030303030303030303014303030303030303030303030303030303027290A000100000001000000000000000000000000000000000000000000000004010000000000000000000000000000000000000000000000');