[Snort-sigs] sigs to catch response traffic

Russell Fulton r.fulton at ...575...
Sun Jul 17 18:00:42 EDT 2005


Hi, does stream4 collect both directions of a flow?  I.e. is it possible to have a set of signatures that tags a flow (standard http attack) and then watched for a 200 response from the web server.

I assume that the answer is no otherwise we would be diong this as a matter of routine.

It long ago got to the stage where I ignore the flood of altert generated by people poking at our web servers.  The fact that some poked at our web server is of no interest at all.  The fact that someone poked at the web server and the server did not return an error is of interest.

Perhaps this could be built into a preprocessor that returns the status on an http connections.

Russell




More information about the Snort-sigs mailing list