×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Auth Failure FTP 6250

Unanswered Question
Jul 28th, 2003
User Badges:

Signature 6250 false positives


after an update from S47 to IDS-sig-3.1-3-S48.zip, the sig 6250 appears incorrect. the service ports are not correct for the signature


any comments regarding this signature are welcome


>.SigWizMenu*

setStorageTimeOut: default value of 300

setMpcPercent: default value of 1

INIT - sigsUserModified =


Startup SigWizMenu v262 (Release) 02/05/08-17:25 : CSIDS Signature Wizard

-Load File: /usr/nr/etc/SigData.conf

Unconsumed token(s) [Attempt to parse Non-Numeric value.] passed to parameter "ServicePorts"

Unconsumed token(s) [Attempt to parse Non-Numeric value.] passed to parameter "ServicePorts"

Null String passed to String Parameter "SigStringInfo"

Null String passed to String Parameter "SigStringInfo"

Null String passed to String Parameter "SigStringInfo"

Null String passed to String Parameter "SigStringInfo"

Unconsumed token(s) [Attempt to parse Non-Numeric value.] passed to parameter "ServicePorts"

Unconsumed token(s) [Attempt to parse Non-Numeric value.] passed to parameter "ServicePorts"

Unconsumed token(s) [Attempt to parse Non-Numeric value.] passed to parameter "ServicePorts"


-Load File: /usr/nr/etc/SigUser.conf

-Load File: /usr/nr/etc/SigSettings.conf



Current Signature: Engine STRING.TCP SIGID 6250

SigName: Auth Failure FTP


1 - AlarmInterval =

2 - AlarmThrottle = FireOnce

3 - ChokeThreshold =

4 - FlipAddr = True

5 - LimitSummary =

6 - MaxInspectLength =

7 - MinHits = 3

8 - MinMatchLength =

9 - MultipleHits =

10 - ResetAfterIdle = 15

11 - ServicePorts = 80,3128,8000,8010,8080,8888

12 - SigComment =

13 - SigStringInfo = Failed FTP Logins

14 - StripTelnetOptions =

15 - ThrottleInterval = 15

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
mcerha Mon, 08/04/2003 - 11:58
User Badges:
  • Bronze, 100 points or more

This has been fixed in signature update S49. Please refer to DDTS# CSCeb69305 for more information.

Actions

This Discussion