[Snort-users] ICMP-Tunneling Preprocessor to IT-Rule
thomas.walpuski at ...158...
Mon Jan 15 12:02:29 EST 2001
I first wanted to write a ICMP-Tunneling-Rule, but it did not know how, because it is impossible to say: "All packets with payload that does NOT include THIS ale ICMP-Tunnelings". So i wrote this Snort Preprocessor Pluging:
void IcmpTunnelInit(u_char *);
void IcmpTunnelPreprocFunction(Packet *);
#endif /* __SPP_ICMP_TUNNEL_H__ */
#define MODNAME "spp_icmp_tunnel"
void IcmpTunnelInit(u_char *args)
void IcmpTunnelPreprocFunction(Packet *p)
if(!(p->iph && p->iph->ip_proto == IPPROTO_ICMP && (p->icmph->type == ICMP_ECHOREPLY || p->icmph->type == ICMP_ECHO)))
p->data += 23;
if (strncmp(p->data, "!\"#$%&'()*+,-./01234567\0", 23) != 0)
printf ("ICMP-Tunneling Alert\n");
If there is a way to write a rule instead of this spp, please tell me how! If it's impossible, can't someone make it possible ?
OpenBSD - Free, Functional, Secure
More information about the Snort-users