[Snort-users] test a threshold rule, please?

Rich Adamson radamson at ...2127...
Thu Aug 5 20:00:12 EDT 2004


Apparently the problem was a Win32 specifc issue that Chris rsolved. He sent a
private email with an executable that addressed the issue, and its now working
just fine. The seconds and count parameters in the example were intended to 
generate some sample alerts, which it did following the fix. I've since increased
those thresholds to realistic numbers. :)

Rich

------------------------

> Rich,
> 
> I don't know if this is one of those "better late than never"
> situations, but I was looking through the archive for something
> resembling your rule below to detect high rates of SYNs and just
> wanted to let you know that this rule, with a few small modifications
> (i changed the count to 25 and seconds to 1) does not cause ANY
> problems in Snort 2.2.0RC1 running on Linux.
> 
> 
> On Tue,  6 Jul 2004 08:41:00 -0600, Rich Adamson <radamson at ...2127...> wrote:
> > 
> > Could someone test the following rule in either linux or win32, please?
> > 
> > alert tcp $HOME_NET any -> any any (msg: "High SYN Traffic"; flags:S; threshold: type
> > threshold, track by_src, seconds 60, count 1; classtype:misc-activity; sid: 1000002;
> > rev:1;)
> > 
> > I'm trying to determine whether the above might indicate be a bug in
> > linux, win32, or syntax error on my part. If I try the above rule in win32
> > (v2.2.0rc1 build 28), snort will not start due to an integer error reading
> > the rule. Inserting  content:" "; offset:0; in the above allows snort to
> > start.
> > 
> > Any help/suggestions would be greatly appreciated. Off-list comments are
> > fine if you'd like.
> > 
> > Rich
> > 
> > -------------------------------------------------------
> > This SF.Net email sponsored by Black Hat Briefings & Training.
> > Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> > digital self defense, top technical experts, no vendor pitches,
> > unmatched networking opportunities. Visit www.blackhat.com
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >

---------------End of Original Message-----------------






More information about the Snort-users mailing list