[Snort-devel] Snort Rules

mosquitooth at ...224... mosquitooth at ...224...
Thu Dec 23 11:24:06 EST 2004


I'm quite a newbie on snort, so please excuse my basic questions:
The following describes the way I understand the behaviour and use of snort
rules in the inernal system. Please comment on this (and correct me :~)).

First of all, snort divides all rules in (at least) 4 parts, based on
protocol (TCP/UDP/ICMP/IP). Now, there's a RuleTreeNode (RTN) for every type
of - let's say TCP - rule 'below' the main protocol list (rules that have
identical src/dest ips AND identical min/max src ports are combined, so you
can check several rules in one time). 
This RTN contains rule information, esp. two linked lists for source and
destination IP addresses and min/max- src/dest port (along with some flags
and other stuff, necessary to check if the current packet belongs to this
rule group).
Additionally, a linked list with the rule-specific barebones exits
(OptTreeNode = OPT). Here you can find the rules metadata and some keywords
(statefule inspection).
And that's exactly the point where I'm hampered. AFAIK you should find here
e.g. the content to search for, in short: every rule-specific information
that cannot be used to create deeper groups. But there is none!

So, could anyone tell me first, whether the above statements are correct,
second if this also applies to the new rule engine in snort 2.x and third
how the system continues at the point where I'm stucked.

Now, I excuse for my bad english and whish you all 'Merry Christmas'


P.S.: Just to mention, why does snort fire several alerts per packet?
Shouldn't be one enough? 

+++ Sparen Sie mit GMX DSL +++ http://www.gmx.net/de/go/dsl
AKTION für Wechsler: DSL-Tarife ab 3,99 EUR/Monat + Startguthaben

More information about the Snort-devel mailing list