I'm having an issue where when I add a custom rule to my WAN interface(SNORT), I can't start the interface, not even the simplest ping rules work now despite having worked just fine all day.

Trouble started after I started doing some test monitoring of some SMB traffic with the following rule:

alert tcp any any -> $HOME_NET[139, 445] (msg:"Home network SMB triggered"; flow:to_server,established; content:"P|00|S|00|E|00|X|00|E|00|S|00|V|00|C"; nocase; reference:url,xinn.org/Snort-psexec.html; reference:url,doc.emergingthreats.net/2010781; classtype:suspicious-filename-detect; sid:2010781; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Not sure what went wrong, but the rule didn't work, and now my other custom rules don't either(as in they prevent me from starting the interface).

Anyone who knows what has happened?


The problem with your rule is in the spacing.

alert tcp any any -> $HOME_NET[139, 445]

is parsed as

  • SrcIP: any
  • SrcPort: any
  • DstIP: $HOME_NET[139,
  • DstPort: 445]

which is invalid

you want:

alert tcp any any -> $HOME_NET [139,445] 

This will allow the rule to validate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.