[Snort-users] Help with Snort rule - httpd flood detection

Basselgia, Barry A Mr (NAF Atsugi) BABasselgia at ...12104...
Mon Feb 28 17:39:25 EST 2005

I'd suggest checking out www.bleedingsnort.com.  You may find that they
already have a rule to do what you want and they are usually happy to help
people develop new rules.


-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Scott /
Sent: Tuesday, March 01, 2005 5:46 AM
To: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Help with Snort rule - httpd flood detection

If I knew where to even start, I would do so... why I was hoping for some 
help from the list.
So far, I've found nothing, so I'm lost on it.
Thus far, the only content that is consistent throughout the various attacks

are the fact that all the various bots all hit the exact same spot all at 
once.. nothing else is consistent from one attack to the next (other than 
the sender).

----- Original Message ----- 
From: "Jeremy Hewlett" <jh at ...1935...>
To: <snort-users at lists.sourceforge.net>
Sent: Monday, February 28, 2005 1:44 PM
Subject: Re: [Snort-users] Help with Snort rule - httpd flood detection

> On Sat, Feb 26, NightStorm wrote:
>>    What  I  am  hoping  to  do  is somehow get Snort to recognise massive
>>    queries  to a specified page, and then trigger a rule.  Unfortunately,
> Have you tried creating your own rule, looking for whatever content,
> and putting a threshold of type "Both" on it? 

SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list