(http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Oversized Request-URI directories in HTTP requests can sometimes indicate attempts to exploit vulnerabilities in web applications or perform various types of attacks, such as directory traversal attacks. These attacks aim to access files or directories outside of the web server's intended directory structure. The "http_inspect" preprocessor in Snort monitors the HTTP traffic, and when it encounters an HTTP request with an excessively large Request-URI directory, it triggers this alert
(http_inspect) JUNK LINE BEFORE HTTP RESPONSE HEADER
The rule is designed to trigger an alert when it detects a junk line or invalid data before the response headers in an HTTP server's response. Normally, an HTTP response should start with a valid set of response headers, and any deviation from this expected format may indicate a potential issue or anomaly in the server's response.
(http_inspect) INVALID CHUNK SIZE OR CHUNK SIZE FOLLOWED BY JUNK CHARACTERS
The rule is designed to trigger an alert when it detects invalid chunked data in the HTTP response during a chunked transfer encoding scenario. This can happen if the server sends an HTTP response with chunked data that does not adhere to the proper syntax or format required for chunked transfer encoding. Invalid chunked data in an HTTP response could indicate potential issues or anomalies in the server's response.
NF – Don’t Fragment bit set – check for covert channel
The purpose of this rule is to potentially detect patterns associated with covert channels that abuse ICMP echo requests with the Don't Fragment bit set
NF – TTL below 30 – TTL Expiry Attack from inside to outside
A TTL (Time To Live) below 30 attack refers to a specific type of network attack where an attacker intentionally sets the TTL value to a very low value (typically below 30) in packets they send out. This attack aims to exploit the Time To Live mechanism in the IP protocol to perform reconnaissance or evade network security measures.