[Snort-users] snort and statefull inspection

Brett.Bender at ...3944... Brett.Bender at ...3944...
Mon Oct 29 12:38:02 EST 2001


marc riffel wrote:

I want to implement a rule, so that it is only allowed to connect via
ssh from 192.168.66.99  to other servers.
Any other inbound or outbound communication should be logged.

So i wrote the rule:
alert tcp 192.168.66.99 any -> any !22 (msg:" serverXY do a not
allowed outbound connection";)
alert tcp any any -> 192.168.66.99 any (msg:"not allowed inbound
connection";)

Use the "flags" option on your rules. The first step in making a TCP 
connection is a packet with the SYN flag set. So you can write rules:

alert tcp 192.168.66.99 any -> any !22 (msg:"serverXY making prohibited 
connection out"; flags: S+;)
alert tcp any any -> 192.168.66.99 any (msg:"serverXY receiving prohibited 
connection in"; flags: S+;)

These will catch the attempt to establish the connection. You can write a 
similar rule (opposite direction, flags: SA+) for the SYN-ACK reply if you 
also want to know if the connection attempt was successful.




More information about the Snort-users mailing list