On Sun, 2 Jul 2007, [EMAIL PROTECTED] wrote:
I am sort of new to IDS. I am writing rule for IPS. If i have a rule
which requires monitoring the argument of Mail From : SMTP command, then
it may happen that my rule can get triggered inside the body of emails
giving me false positives.
Any suggestions how can i remove such false positives ?
if your IDS doesn't keep track of the SMTP dialogue (IIRC NFR used to, as
an example), you can specify a maximum search depth for the MAIL FROM
command. alternatively, if you have to write regular expressions, you can
enforce the MAIL FROM command coming after the HELO or EHLO command and
before the RCPT TO command. the regex's get a bit hairy there, though.
hope that helps.
________
jose nazario, ph.d. [EMAIL PROTECTED]
http://monkey.org/~jose/ http://monkey.org/~jose/secnews.html
http://www.wormblog.com/
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
