[Snort-sigs] excessive simultaneous connections like iplimit ??

paddy paddy at ...2946...
Mon Jan 3 09:34:05 EST 2005


I thought I'd try to get snort to log instances where I see 
excessive simultaneous connections from the same host to a
service.  something like the netfilter iplimit patch, but
logging rather than responding.

I've waded through the manual and the FAQ, but it hasn't sunk
in yet.

Would anyone suggest to me how it would be done?

Perl 6 will give you the big knob. -- Larry Wall

More information about the Snort-sigs mailing list