Custom Snort rule prevent me from starting the WAN interface

Question

I'm having an issue where when I add a custom rule to my WAN interface(SNORT), I can't start the interface, not even the simplest ping rules work now despite having worked just fine all day.

Trouble started after I started doing some test monitoring of some SMB traffic with the following rule:

alert tcp any any -> $HOME_NET[139, 445] (msg:"Home network SMB triggered"; flow:to_server,established; content:"P|00|S|00|E|00|X|00|E|00|S|00|V|00|C"; nocase; reference:url,xinn.org/Snort-psexec.html; reference:url,doc.emergingthreats.net/2010781; classtype:suspicious-filename-detect; sid:2010781; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Not sure what went wrong, but the rule didn't work, and now my other custom rules don't either(as in they prevent me from starting the interface).

Anyone who knows what has happened?

Answer 1

The problem with your rule is in the spacing.

alert tcp any any -> $HOME_NET[139, 445]

is parsed as

• SrcIP: any
• SrcPort: any
• DstIP: $HOME_NET[139,
• DstPort: 445]

which is invalid

you want:

alert tcp any any -> $HOME_NET [139,445] 

This will allow the rule to validate.