[Snort-users] Help with Rules

Kevin Smith kjsmith at ...13166...
Thu Mar 31 10:13:19 EST 2005


Hey Bruce,

Here is the rule I have been messing around with.
alert tcp $NETWORK any -> any any (tag:session,600,seconds;)

I have also tried
alert tcp $NETWORK any -> any any (tag:host,100,packets,src;)

Where network is defined as:
var NETWORK [64.7.160.0/19]

Mainly, the rules are logging the correct information. The problem is I
am just receiveing way to much information to handle. I have a php
script that is going through the information and sending e-mails to our
support staff to let them know of any possible problems (such as
spy-ware, viruses, etc) to the end user. he problem is that the database
will get up to 100,000 records and when the script runs and removes the
old information for a customer who isn't online any more it will take
forever to remove the information and the system's resources just max
out. If the information is low, in the thousands, it runs fine. So I
would like to get a handle of the packets and log them, versus everyone
that comes across the interface. I thought tag would do that, but I am
guessing it is not.

Any ideas?

Thanks,
Kevin





More information about the Snort-users mailing list