[Snort-users] Noob question about different parts of a rule
mkettler at ...4108...
Mon Apr 28 13:45:02 EDT 2003
At 03:50 PM 4/28/2003 -0400, stormshadow wrote:
>I was looking at this rule trying to learn what everything in there
>alert tcp $HOME_NET 12345:12346 -> $EXTERNAL_NET any (msg:"BACKDOOR
>netbus active"; flow:from_server,established; content:"NetBus";
>reference:arachnids,401; classtype:misc-activity; sid:109; rev:4;)
>Can anyone explain this rule to me? I know that there are 3 modes
>right? (alert, log, and something else). What does the $HOME_NET and
>$EXTERNAL_NET mean? Why do you say "any"?
>Is this rule stating "alert any traffic outbound from port 12345 and
The first part of a snort rule is in the general format:
action protocol source_ip source_port -> destination_ip destination_port.
So the "alert tcp $HOME_NET 12345:12346 -> $EXTERNAL_NET any " part of the
rule translates as:
Alert on packets which are TCP protocol,
an IP address in the range defined by HOME_NET in your snort.conf
with a source ports between 12345 and 12346
an IP address in the range defined by EXTERNAL_NET in your snort.conf
with any destination port
This rule also has a content specifier, so the data also needs to contain
the text-string "NetBus" (case sensitive), and the flow modifier means it
must be going to the client side of the TCP connection 3-way handshake.
More information about the Snort-users