[Snort-sigs] How to reapply a sig on packets in a same session

Matthew Watchinski mwatchinski at ...435...
Fri Jul 16 16:29:00 EDT 2004


What's your current rule look like?

Cheers,
-matt

Chich Thierry wrote:

>
> I would allow snort to apply the same sig on packets that
> are belonging of a same session.
>
> The context : I am trying to kill bittorrent
> connexions with a reset tcp. However, this is not working each time.
> Sometimes, the connexion between the peers stay alive.
>
> Since the sig is apply only once on a single session, if the session 
> survive
> one time, it stay alive for all time.
>
> Is it something that can precise that a signature must be match on
> the datagrams without taking care of the stream ?
>
> Thierry
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by BEA Weblogic Workshop
> FREE Java Enterprise J2EE developer tools!
> Get your free copy of BEA WebLogic Workshop 8.1 today.
> http://ads.osdn.com/?ad_id=4721&alloc_id=10040&op=click
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-sigs
>





More information about the Snort-sigs mailing list