[Snort-users] Filter SYN ACK

Matt Kettler mkettler at ...4108...
Wed Jan 30 11:27:03 EST 2002


I assume you're writing some semi-custom snort rules to do what you need.

If that is the case, use the 'flags' rule feature. Adding "flags: A+" will 
cause rules to match tcp packets which have the ack bit set, but any other 
flags (which is probably what you want).

Based on the documentation  I think "flags: A!S!F+" should match any packet 
with the ack bit set, but no Syn-Ack or Fin-Ack packets. But I suspect 
"flags: A+" is probably better, this is what all the normal snort rules do.

As for only packets containing get/post, you might look at the uricontent 
rule option... I'm not too familiar with it, but it seems like it might do 
part of what you need.

At 11:04 PM 1/29/2002 -0500, Warrick FitzGerald wrote:
>Hi All,
>
>Im hoping you guys have a better idea than some very tedious ones that I
>have tried.
>
>I am trying to filter HTTP draffic, which is easy enough, but I would only
>like to capture packets that contain application layer data ie. a GET or
>POST etc. does anyone know an easy way / basic filter than can do this for
>me ?
>
>Thanks
>Warrick
>
>
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users





More information about the Snort-users mailing list