icmp-info.rules

来自「入侵检测系统.linux下与MySql连用的例子」· RULES 代码 · 共 114 行

# $Id: icmp-info.rules,v 1.4 2001/07/29 16:36:35 cazz Exp $
#
# ICMP-INFO RULES
#
# Description:
# These rules are standard ICMP traffic.  They include OS pings, as well
# as normal routing done by ICMP.  There are a number of "catch all" rules
# that will alert on unknown ICMP types.
#
# Potentially "BAD" ICMP rules are included in icmp.rules

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IRDP router advertisement";itype:9; reference:bugtraq,578; reference:cve,CVE-1999-0875; reference:arachnids,173; sid:363; rev:2;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IRDP router selection";itype:10; reference:bugtraq,578; reference:cve,CVE-1999-0875; reference:arachnids,174; sid:364; rev:2;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING (Undefined Code!)"; itype: 8; sid:365; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING *NIX"; content:"|101112131415161718191a1b1c1d1e1f|";itype:8;depth:32; sid:366; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BSDtype"; itype: 8; content:"|08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17|"; depth: 32; reference:arachnids, 152; sid:367; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BSDtype"; itype:8; content:"|08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17|"; depth:32; reference:arachnids,152; sid:368; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BayRS Router"; itype: 8; content:"|0102030405060708090a0b0c0d0e0f|"; depth:32; reference:arachnids,438; reference:arachnids,444; sid:369; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BeOS4.x"; content:"|00000000000000000000000008090a0b|";itype:8;depth:32; reference:arachnids,151; sid:370; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Cisco Type.x"; content:"|abcdabcdabcdabcdabcdabcdabcdabcd|";itype:8;depth:32; reference:arachnids,153; sid:371; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Delphi-Piette Windows"; content:"|50696e67696e672066726f6d2044656c|"; itype:8; depth:32; reference:arachnids,155; sid:372; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Flowpoint2200 or Network Management Software"; itype:8; content:"|0102030405060708090a0b0c0d0e0f10|"; depth:32; reference:arachnids,156; sid:373; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING IP NetMonitor Macintosh"; content:"|a9205375737461696e61626c6520536f|"; itype:8; depth:32; reference:arachnids,157; sid:374; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING LINUX/*BSD"; dsize:8; itype:8; id:13170; reference:arachnids,447; sid:375; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Microsoft Windows"; content:"|303132333435363738396162636465666768696a6b6c6d6e6f70|"; itype:8; depth:32; reference:arachnids,159; sid:376; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Network Toolbox 3 Windows"; content:"|3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d|";itype:8;depth:32; reference:arachnids,161; sid:377; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Ping-O-MeterWindows"; content:"|4f4d 6574 6572 4f62 6573 6541 726d 6164|"; itype:8; depth:32; reference:arachnids,164; sid:378; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Pinger Windows"; content:"|44617461000000000000000000000000|"; itype:8; depth:32; reference:arachnids,163; sid:379; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Seer Windows"; content:"|88042020202020202020202020202020|"; itype:8; depth:32; reference:arachnids,166; sid:380; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Sun Solaris"; dsize:8; itype:8; reference:arachnids,448; sid:381; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Windows"; content: "|61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70|"; itype: 8; depth: 16; reference:arachnids,169; sid:382; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING from Flowpoint2200 or Network Management Software"; itype: 8; content: "|0102030405060708090a0b0c0d0e0f10|"; depth: 32;reference:arachnids,156; sid:383; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING"; itype: 8; icode: 0; sid:384; rev:1;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP traceroute ";ttl:1;itype:8; reference:arachnids,118; classtype:attempted-recon; sid:385; rev:1;)
alert icmp any any -> any any (msg:"ICMP Address Mask Reply"; itype: 18; icode: 0; sid:386; rev:1;)
alert icmp any any -> any any (msg:"ICMP Address Mask Reply (Undefined Code!)"; itype: 18; sid:387; rev:1;)
alert icmp any any -> any any (msg:"ICMP Address Mask Request"; itype: 17; icode: 0; sid:388; rev:1;)
alert icmp any any -> any any (msg:"ICMP Address Mask Request (Undefined Code!)"; itype: 17; sid:389; rev:1;)
alert icmp any any -> any any (msg:"ICMP Alternate Host Address"; itype: 6; icode: 0; sid:390; rev:1;)
alert icmp any any -> any any (msg:"ICMP Alternate Host Address (Undefined Code!)"; itype: 6; sid:391; rev:1;)
alert icmp any any -> any any (msg:"ICMP Datagram Conversion Error"; itype: 31; icode: 0; sid:392; rev:1;)
alert icmp any any -> any any (msg:"ICMP Datagram Conversion Error (Undefined Code!)"; itype: 31; sid:393; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Destination Host Unknown)"; itype: 3; icode: 7; sid:394; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Destination Network Unknown)"; itype: 3; icode: 6; sid:395; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Fragmentation Needed and DF bit was set)"; itype: 3; icode:4; sid:396; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Host Precedence Violation)"; itype: 3; icode: 14; sid:397; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Host Unreachable for Type of Service)"; itype: 3; icode: 12; sid:398; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Host Unreachable)"; itype: 3; icode: 1; sid:399; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Network Unreachable for Type of Service)"; itype: 3; icode:11; sid:400; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Network Unreachable)"; itype: 3; icode: 0; sid:401; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Port Unreachable)"; itype: 3; icode: 3; sid:402; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Precedence Cutoff in effect)"; itype: 3; icode: 15; sid:403; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Protocol Unreachable)"; itype: 3; icode: 2; sid:404; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Source Host Isolated)"; itype: 3; icode: 8; sid:405; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Source Route Failed)"; itype: 3; icode: 5; sid:406; rev:1;)
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Undefined Code!)"; itype: 3; sid:407; rev:1;)
alert icmp any any -> any any (msg:"ICMP Echo Reply"; itype: 0; icode: 0; sid:408; rev:1;)
alert icmp any any -> any any (msg:"ICMP Echo Reply (Undefined Code!)"; itype: 0; sid:409; rev:1;)
alert icmp any any -> any any (msg:"ICMP Fragment Reassembly Time Exceeded"; itype: 11; icode: 1; sid:410; rev:1;)
alert icmp any any -> any any (msg:"ICMP IPV6 I-Am-Here"; itype: 34; icode: 0; sid:411; rev:1;)
alert icmp any any -> any any (msg:"ICMP IPV6 I-Am-Here (Undefined Code!"; itype: 34; sid:412; rev:1;)
alert icmp any any -> any any (msg:"ICMP IPV6 Where-Are-You"; itype: 33; icode: 0; sid:413; rev:1;)
alert icmp any any -> any any (msg:"ICMP IPV6 Where-Are-You (Undefined Code!)"; itype: 33; sid:414; rev:1;)
alert icmp any any -> any any (msg:"ICMP Information Reply"; itype: 16; icode: 0; sid:415; rev:1;)
alert icmp any any -> any any (msg:"ICMP Information Reply (Undefined Code!)"; itype: 16; sid:416; rev:1;)
alert icmp any any -> any any (msg:"ICMP Information Request"; itype: 15; icode: 0; sid:417; rev:1;)
alert icmp any any -> any any (msg:"ICMP Information Request (Undefined Code!)"; itype: 15; sid:418; rev:1;)
alert icmp any any -> any any (msg:"ICMP Mobile Host Redirect"; itype: 32; icode: 0; sid:419; rev:1;)
alert icmp any any -> any any (msg:"ICMP Mobile Host Redirect (Undefined Code!)"; itype: 32; sid:420; rev:1;)
alert icmp any any -> any any (msg:"ICMP Mobile Registration Reply"; itype: 36; icode: 0; sid:421; rev:1;)
alert icmp any any -> any any (msg:"ICMP Mobile Registration Reply (Undefined Code!)"; itype: 36; sid:422; rev:1;)
alert icmp any any -> any any (msg:"ICMP Mobile Registration Request"; itype: 35; icode: 0; sid:423; rev:1;)
alert icmp any any -> any any (msg:"ICMP Mobile Registration Request (Undefined Code!"; itype: 35; sid:424; rev:1;)
alert icmp any any -> any any (msg:"ICMP Parameter Problem (Bad Length)"; itype: 12; icode: 2; sid:425; rev:1;)
alert icmp any any -> any any (msg:"ICMP Parameter Problem (Missing a Requiered Option)"; itype: 12; icode: 1; sid:426; rev:1;)
alert icmp any any -> any any (msg:"ICMP Parameter Problem (Unspecified Error)"; itype: 12; icode: 0; sid:427; rev:1;)
alert icmp any any -> any any (msg:"ICMP Parameter Problem (Undefined Code!)"; itype: 12; sid:428; rev:1;)
alert icmp any any -> any any (msg:"ICMP Photuris (Reserved)"; itype: 40; icode: 0; sid:429; rev:1;)
alert icmp any any -> any any (msg:"ICMP Photuris (Unknown Security Parameters Index)"; itype: 40; icode: 1; sid:430; rev:1;)
alert icmp any any -> any any (msg:"ICMP Photuris (Valid Security Parameters, But Authentication Failed)"; itype: 40; icode: 2; sid:431; rev:1;)
alert icmp any any -> any any (msg:"ICMP Photuris (Valid Security Parameters, But Decryption Failed)"; itype: 40; icode: 3; sid:432; rev:1;)
alert icmp any any -> any any (msg:"ICMP Photuris (Undefined Code!)"; itype: 40; sid:433; rev:1;)
alert icmp any any -> any any (msg:"ICMP Redirect (Host)"; itype:5; icode:1; reference:arachnids,135; reference:cve,CVE-1999-0265; sid:434; rev:1;)
alert icmp any any -> any any (msg:"ICMP Redirect (Network)"; itype:5; icode:0; reference:arachnids,199; reference:cve,CVE-1999-0265; sid:435; rev:1;)
alert icmp any any -> any any (msg:"ICMP Redirect (for TOS and Host)"; itype: 5; icode: 3; sid:436; rev:1;)
alert icmp any any -> any any (msg:"ICMP Redirect (for TOS and Network)"; itype: 5; icode: 2; sid:437; rev:1;)
alert icmp any any -> any any (msg:"ICMP Redirect (Undefined Code!)"; itype: 5; sid:438; rev:1;)
alert icmp any any -> any any (msg:"ICMP Reserved for Security (Type 19)"; itype: 19; icode: 0; sid:439; rev:1;)
alert icmp any any -> any any (msg:"ICMP Reserved for Security (Type 19) (Undefined Code!)"; itype: 19; sid:440; rev:1;)
alert icmp any any -> any any (msg:"ICMP Router Advertisment"; itype: 9; icode: 0; reference:arachnids,173; sid:441; rev:1;)
alert icmp any any -> any any (msg:"ICMP Router Advertisment (Undefined Code!)"; itype: 9; reference:arachnids,173; sid:442; rev:1;)
alert icmp any any -> any any (msg:"ICMP Router Selection"; itype: 10; icode: 0; reference:arachnids,174; sid:443; rev:1;)
alert icmp any any -> any any (msg:"ICMP Router Selection (Undefined Code!)"; itype: 10; reference:arachnids,174; sid:444; rev:1;)
alert icmp any any -> any any (msg:"ICMP SKIP"; itype: 39; icode: 0; sid:445; rev:1;)
alert icmp any any -> any any (msg:"ICMP SKIP (Undefined Code!"; itype: 39; sid:446; rev:1;)
alert icmp any any -> any any (msg:"ICMP Source Quench"; itype: 4; icode: 0; sid:447; rev:1;)
alert icmp any any -> any any (msg:"ICMP Source Quench (Undefined Code!)"; itype: 4; sid:448; rev:1;)
alert icmp any any -> any any (msg:"ICMP Time-To-Live Exceeded in Transit"; itype: 11; icode: 0; sid:449; rev:1;)
alert icmp any any -> any any (msg:"ICMP Time-To-Live Exceeded in Transit (Undefined Code!)"; itype: 11; sid:450; rev:1;)
alert icmp any any -> any any (msg:"ICMP Timestamp Reply"; itype: 14; icode: 0; sid:451; rev:1;)
alert icmp any any -> any any (msg:"ICMP Timestamp Reply (Undefined Code!)"; itype: 14; sid:452; rev:1;)
alert icmp any any -> any any (msg:"ICMP Timestamp Request"; itype: 13; icode: 0; sid:453; rev:1;)
alert icmp any any -> any any (msg:"ICMP Timestamp Request (Undefined Code!)"; itype: 13; sid:454; rev:1;)
alert icmp any any -> any any (msg:"ICMP Traceroute ipopts"; ipopts: rr; itype: 0; reference:arachnids,238; sid:455; rev:1;)
alert icmp any any -> any any (msg:"ICMP Traceroute"; itype: 30; icode: 0; sid:456; rev:1;)
alert icmp any any -> any any (msg:"ICMP Traceroute (Undefined Code!)"; itype: 30; sid:457; rev:1;)
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 1)"; itype: 1; icode: 0; sid:458; rev:1;)
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 1) (Undefined Code)"; itype: 1; sid:459; rev:1;)
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 2)"; itype: 2; icode: 0; sid:460; rev:1;)
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 2) (Undefined Code); itype: 2; sid:461; rev:1;)
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 7)"; itype: 7; icode: 0; sid:462; rev:1;)
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 7) (Undefined Code!)"; itype: 7; sid:463; rev:1;)
alert icmp any any -> any any (msg:"ICMP Unknown Type"; sid:464; rev:1;)