[Snort-users] Filter SYN ACK
mkettler at ...4108...
Wed Jan 30 11:27:03 EST 2002
I assume you're writing some semi-custom snort rules to do what you need.
If that is the case, use the 'flags' rule feature. Adding "flags: A+" will
cause rules to match tcp packets which have the ack bit set, but any other
flags (which is probably what you want).
Based on the documentation I think "flags: A!S!F+" should match any packet
with the ack bit set, but no Syn-Ack or Fin-Ack packets. But I suspect
"flags: A+" is probably better, this is what all the normal snort rules do.
As for only packets containing get/post, you might look at the uricontent
rule option... I'm not too familiar with it, but it seems like it might do
part of what you need.
At 11:04 PM 1/29/2002 -0500, Warrick FitzGerald wrote:
>Im hoping you guys have a better idea than some very tedious ones that I
>I am trying to filter HTTP draffic, which is easy enough, but I would only
>like to capture packets that contain application layer data ie. a GET or
>POST etc. does anyone know an easy way / basic filter than can do this for
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>Snort-users list archive:
More information about the Snort-users