[Snort-users] Help with Rules

Briggs, Bruce Bruce.Briggs at ...13183...
Thu Mar 31 07:02:22 EST 2005

What alert rules have you set up?


-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Kevin
Sent: Wednesday, March 30, 2005 10:32 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Help with Rules

To anyone who can help,

I am a bit confused on writing rules. I am trying to write, at least 
what I think a pretty simple rule. Basically we have all the traffic 
filtered out, meaning any traffic that is not going to an IP address 
will be sent to the snort box. With this we are going to determine if 
the user is having say spy-ware or virus related problems so we can 
notify them. I am running into trouble getting my rules to work, or they

work so well, it just fills the database up to an unmanageable level.

My question is that right now it is logging what appears to be any 
packet sent by the user. I would like to get a handful of that 
information, for example, have 1 log for every 100 packets. Is this 
possible? If so, what options do I need to use?


This SF.net email is sponsored by Demarc:
A global provider of Threat Management Solutions.
Download our HomeAdmin security software for free today!
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list