[Snort-users] content question

Martin Roesch roesch at ...1935...
Sun Sep 29 17:39:02 EDT 2002

In 1.8.x you can do this:

Alert tcp $HOME_NET $SOMEPORT -> any any (content: "DCC SEND"; nocase;
content: ".mp3"; nocase; msg: "MP3 DCC Found";)

In 1.9 you can do this:

Alert tcp $HOME_NET $SOMEPORT -> any any (flow: established, from_client;
content: "DCC SEND"; nocase; content: ".mp3"; distance: 1; nocase; msg: "MP3
DCC Found";)

The "distance" keyword gives you a relative offset from the end of the last
match, so it basically acts as a wildcarding mechanism.  You can also use
the new "within" keyword to limit how deep into the packet from the end of
the distance it'll search before it stops.


On 9/29/02 4:43 AM, "Petre Bandac" <petre at ...6894...> wrote:

> I want to block all dcc sends which contain mp3, avi, mpeg and other large
> files, allowing the rest
> am I allowd to use a wildcard in the content rule ? I presume not (haven't
> tried yet, though).
> can I concatenate two/more content rules ?
> my content text looks like this: DCC SEND any_file_name.mp3, and I am
> interested only in DCC SEND and the extension
> thanks,
> petre

Martin Roesch - Founder/CTO Sourcefire Inc. - (410) 290-1616
Sourcefire: Professional Snort Sensor and Management Console appliances
roesch at ...1935... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org

More information about the Snort-users mailing list