[Snort-users] tracking failing TCP connection attempts with snort

Jim Hendrick jrhendri at ...9784...
Tue Nov 16 18:03:09 EST 2004


Hi,

  I am looking for a way to alert (or log) on failing incoming TCP
connections.

For example, if an inbound connection attempts to connect to a server, and
the server never responds, I'd like something that can alert. 

I have been looking at using tagged connections, but I'm not sure how to
setup the "alert if a connection is *not* established" logic.

I know something like this will tag inbound connections from "host" for 30
seconds:

alert tcp any any -> $HTTP_SERVERS 80 (flags: S; \
  tag: host, 30, seconds; msg: "incoming http session";)

But how can I continue and say:

alert {"magic syntax here": tcp $HTTP_SERVERS 80 -> host \
  (30 seconds and no SYN/ACK); msg: "failed HTTP connection attempt";)

?????

Thanks for any tips!

Jim Hendrick






More information about the Snort-users mailing list