VMS 2.2 - TCP Reset to a word belonging to a URL

[luiz.barreto]

Does anyone know how to deny access to a site by doing a TCP Reset to a string on the site's domain name (using an IDS MC Custom Signature)?

[jimwelsh]

Create a STRING.HTTP custom signature. Make it "ToService". Set the RegexString to an appropriate Regular Expression for the URL. Enable it, and set the Action to "Reset".

If you need specifics, let me know. Please specify the domain name you wish to block.

Off-topic. I'd do this by having my local DNS server clain to be authoritative for that domain, and have no A records for it!

[luiz.barreto]

Hi Jim

I use IDS MC 1.2 and it doesn't has the engine STRING.HTTP.

I used STRING.TCP and the string letters (RegexString) between brackets but it didn't work.

About the DNS I don't think it is effective because the employees could use the IP address or use another DNS server.

I am waiting another idea from you.

Thanks.

[jimwelsh]

What was your RegexString that you tried?

Give me a specific example of a URL you want to block. Of course, if the user uses an IP Address, then you won't get the URL in the HTTP Headers, anyway.

[jimwelsh]

OOPS. My bad. I meant SERVICE.HTTP in my earlier post.

[luiz.barreto]

One URL I want to reset is www.parperfeito.com.br so the string to be reset would be parperfeito.

[jimwelsh]

Try:

[Pp][Aa][Rr][Pp][Ee][Ff][Ee][Ii][Tt][Oo]

You could get fancier (like specifying the "dot" chars with "\." before and after, and so forth), but this string seems unique enough to do the job.

Also, make sure you set the AlarmThrottle to "FireAll".

[jimwelsh]

I meant "[Pp][Aa][Rr][Pp][Ee][Rr][Ff][Ee][Ii][Tt][Oo]", obviously.

[jimwelsh]

OK, I tested tonight on an appliance, and the RequestRegex I used that is less likely to cause false positives is:

\x0d\x0a[Hh][Oo][Ss][Tt]: .*[Pp][Aa][Rr][Pp][Ee][Rr][Ff][Ee][Ii][Tt][Oo]\x2e[Cc][Oo][Mm]\x2e[Bb][Rr]\x0d\x0a

HTH

[luiz.barreto]

I tested this last suggestion and it didn't work with the engine SERVICE.HTTP.

[jimwelsh]

Please define "didn't work".

[luiz.barreto]

The connection was not reset.