[Snort-users] Doubts creating rules

Joe McAlerney joey at ...47...
Mon Oct 29 11:30:02 EST 2001

Hello Federico,

Federico wrote:
> I've two "logical" problem, help me to solve it.
> 1) first doubt:
> I've a net:
> >From this net, the, and can connect
> to only with log, the others component of must
> generate an alert... wich rule I must create?


log tcp $EXCLUDED_HOSTS any -> any (msg: "connection
attempted"; flags:S;)

This one will alert on all connection attempts from any address that is
not $EXCLUDED_HOSTS.  Unfortunately, this includes addresses outside the range as well.  I couldn't think of a way to specify minus $EXCLUDED_HOSTS.  Maybe someone else can chime in.

alert tcp !$EXCLUDED_HOSTS any -> any (msg: "connection
attempted"; flags:S;)
> 2) Second Doubt (Established Connections)
> I protect my host with snort, so I've done this rule
> alert tcp HOST-B any -> HOST-A any (msg: "connection attempted";)
> when HOST-A connect to HOST-B:139 for netbios share, the HOST-B response the
> connection for establishing it, and snort generate an alert from it... I
> need only snort to log HOST-B attemp to HOST-A not, just established
> connection and data transfer.
> How to solve this problem ?

Specify that you only wish to look for SYN packets, which indicate the
beginning of a TCP connection:

 alert tcp HOST-B any -> HOST-A any (msg: "connection attempted";

Hope this helps,

-Joe M.

|   Joe McAlerney     joey at ...155...   |
| Silicon Defense - Technical Support for Snort |
|       http://www.silicondefense.com/          |
+--                                           --+

More information about the Snort-users mailing list