[Snort-users] snort and statefull inspection

Brett.Bender at ...3944... Brett.Bender at ...3944...
Mon Oct 29 12:38:02 EST 2001

marc riffel wrote:

I want to implement a rule, so that it is only allowed to connect via
ssh from  to other servers.
Any other inbound or outbound communication should be logged.

So i wrote the rule:
alert tcp any -> any !22 (msg:" serverXY do a not
allowed outbound connection";)
alert tcp any any -> any (msg:"not allowed inbound

Use the "flags" option on your rules. The first step in making a TCP 
connection is a packet with the SYN flag set. So you can write rules:

alert tcp any -> any !22 (msg:"serverXY making prohibited 
connection out"; flags: S+;)
alert tcp any any -> any (msg:"serverXY receiving prohibited 
connection in"; flags: S+;)

These will catch the attempt to establish the connection. You can write a 
similar rule (opposite direction, flags: SA+) for the SYN-ACK reply if you 
also want to know if the connection attempt was successful.

More information about the Snort-users mailing list