[Snort-users] Logging non tcp/udp/icmp packets
jsage at ...2022...
Mon Mar 4 07:49:12 EST 2002
..I think you may need to read "Chapter 2 - Writing Snort Rules
How to Write Snort Rules and Keep Your Sanity"
The next field in a rule is the protocol. There are four Protocols
that Snort currently analyzes for suspicious behavior - tcp, udp,
icmp, and ip.
In the future there may be more, such as ARP, IGRP,
GRE, OSPF, RIP, IPX, etc."
IP is, of course, the glue for the other 3: tcp udp and icmp
But I think you may need to wait a while for the others, apparently.
Running under Linux, at least, I do have these *ipchains* rules:
# test for igmp packets
/sbin/ipchains -A input -i $extint -s 0.0.0.0/0 -p 2 -d $extip -j DENY -l
# rule 6
# test for GRE/pptp packets
/sbin/ipchains -A input -i $extint -s 0.0.0.0/0 -p 47 -d $extip -j DENY -l
# rule 7
# test for SIPP-ESP packets
/sbin/ipchains -A input -i $extint -s 0.0.0.0/0 -p 50 -d $extip -j DENY -l
# rule 8
# test for SIPP-AH packets
/sbin/ipchains -A input -i $extint -s 0.0.0.0/0 -p 51 -d $extip -j DENY -l
# rule 9
so the Linux kernel does recognize these other protocols.
I might say that I've seen 2 - igmp - and 50 - SIPP-ESP - only once or twice..
Most people don't type their own logfiles; but, what do I care?
On Mon, Mar 04, 2002 at 03:30:14PM +0530, Sonika Malhotra wrote:
> I would also like to know if this "[!tcp || !udp || !icmp] " works for port
> numbers also.
> log any any -> $HOME_NET [!25 && !53] (msg:"unknown traffic";)
> "Thomas Porter, Ph.D." wrote:
> > I'd like to log all non tcp/udp/icmp packets inbound or outbound. What's
> > the right syntax for the rule below? Thanks
> > # Logging uncommon protocols
> > log [!tcp || !udp || !icmp] $EXTERNAL_NET any <> $HOME_NET any (msg:
> > "Unknown Protocol";session: printable;)
More information about the Snort-users