[Snort-users] Help with Rules
kevin.smith at ...13167...
Thu Mar 31 06:32:10 EST 2005
To anyone who can help,
I am a bit confused on writing rules. I am trying to write, at least
what I think a pretty simple rule. Basically we have all the traffic
filtered out, meaning any traffic that is not going to an IP address
will be sent to the snort box. With this we are going to determine if
the user is having say spy-ware or virus related problems so we can
notify them. I am running into trouble getting my rules to work, or they
work so well, it just fills the database up to an unmanageable level.
My question is that right now it is logging what appears to be any
packet sent by the user. I would like to get a handful of that
information, for example, have 1 log for every 100 packets. Is this
possible? If so, what options do I need to use?
More information about the Snort-users