[Snort-users] Help with Rules

Basselgia, Barry A Mr (NAF Atsugi) BABasselgia at ...12104...
Thu Mar 31 16:20:56 EST 2005

Have you checked out the bleeding edge rules at www.bleedingsnort.com, they
have a very good collection of virus, spyware, adware rules.  


-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Kevin Smith
Sent: Friday, April 01, 2005 3:13 AM
To: Briggs, Bruce; snort-users at lists.sourceforge.net
Subject: [Snort-users] Help with Rules

Hey Bruce,

Here is the rule I have been messing around with.
alert tcp $NETWORK any -> any any (tag:session,600,seconds;)

I have also tried
alert tcp $NETWORK any -> any any (tag:host,100,packets,src;)

Where network is defined as:
var NETWORK []

Mainly, the rules are logging the correct information. The problem is I
am just receiveing way to much information to handle. I have a php
script that is going through the information and sending e-mails to our
support staff to let them know of any possible problems (such as
spy-ware, viruses, etc) to the end user. he problem is that the database
will get up to 100,000 records and when the script runs and removes the
old information for a customer who isn't online any more it will take
forever to remove the information and the system's resources just max
out. If the information is low, in the thousands, it runs fine. So I
would like to get a handle of the packets and log them, versus everyone
that comes across the interface. I thought tag would do that, but I am
guessing it is not.

Any ideas?


This SF.net email is sponsored by Demarc:
A global provider of Threat Management Solutions.
Download our HomeAdmin security software for free today!
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list