111-17.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule: 

--
Sid: 
111-17

-- 
Summary: 
This event is generated when the pre-processor stream4
detects network traffic that may constitute an attack.

-- 
Impact: 
Unknown. This may be an IDS evasion attempt.

--
Detailed Information:
The pre-processor stream4 has detected a TCP session that contains
retransimitted data without the necessary retransmission request. This
may be an attempt to evade any monitoring IDS.

It may be possible for an attacker to send multiple small packets to a
host then disguise an actual attack in a retransmitted packet to that
same host.

--
Affected Systems:
	All systems

--
Attack Scenarios: 
An attacker could cause a host to send multiple acknowledgement packets
then supply one large malicious packet to the host disguised as a
retransmission of data.

-- 
Ease of Attack: 
Difficult.

-- 
False Positives:
None Known.

--
False Negatives:
None Known.

-- 

Corrective Action:
Check the target host for signs of compromise.

Ensure the system is up to date with any appropriate vendor supplied patches.

--
Contributors:
Martin Roesch <[e-mail]>
Sourcefire Vulnerability Research Team
Nigel Houghton <[e-mail]>

-- 
Additional References:

--