[Snort-users] writing snort rules

McCammon, Keith Keith.McCammon at ...3497...
Tue Feb 26 12:51:08 EST 2002


If you see the Snort documentation (site is down right now, but will
surely return soon), there is a "Writing Snort Rules" section that
explains just about everything that you need to know.
 
And that will be one drink, folks.  Bottoms up!

-----Original Message-----
From: Peter.VE at ...1187... [mailto:Peter.VE at ...1187...]
Sent: Tuesday, February 26, 2002 3:19 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] writing snort rules



Hi all,
 
After 4 months of testing snort (with success), I want to start writing
my own snort rules.
Are there any faq's out there ? tips&tricks ?
 
for example :
how can I detect any type of traffic (tcp or udp, on all ports), from
the inside (so from $HOME_NET), to a given IP on the internet (to any) ?
THis seems like an easy rule to write, but it doesn't work...
 
a little bit of help is greatly appreciated
 
thanks
 
 
 
_______________________________________________ Snort-users mailing list
Snort-users at lists.sourceforge.net Go to this URL to change user options
or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=ort-users 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20020226/3e6ebb9b/attachment.html>


More information about the Snort-users mailing list