[Snort-users] Filter SYN ACK

Matt Kettler mkettler at ...4108...
Wed Jan 30 11:27:03 EST 2002

I assume you're writing some semi-custom snort rules to do what you need.

If that is the case, use the 'flags' rule feature. Adding "flags: A+" will 
cause rules to match tcp packets which have the ack bit set, but any other 
flags (which is probably what you want).

Based on the documentation  I think "flags: A!S!F+" should match any packet 
with the ack bit set, but no Syn-Ack or Fin-Ack packets. But I suspect 
"flags: A+" is probably better, this is what all the normal snort rules do.

As for only packets containing get/post, you might look at the uricontent 
rule option... I'm not too familiar with it, but it seems like it might do 
part of what you need.

At 11:04 PM 1/29/2002 -0500, Warrick FitzGerald wrote:
>Hi All,
>Im hoping you guys have a better idea than some very tedious ones that I
>have tried.
>I am trying to filter HTTP draffic, which is easy enough, but I would only
>like to capture packets that contain application layer data ie. a GET or
>POST etc. does anyone know an easy way / basic filter than can do this for
>me ?
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:

More information about the Snort-users mailing list