[Snort-users] Rule help

Jefferson, Shawn Shawn.Jefferson at ...14448...
Tue Dec 23 15:29:55 EST 2008


Is this in the docs anywhere? I've got the rule writing section in front of me and didn't see that in the protocol section.  That would have been nice to know up front. :)

-----Original Message-----
From: Jack Pepper [mailto:pepperjack at ...14319...] 
Sent: December 23, 2008 12:22 PM
To: Jefferson, Shawn
Cc: Snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Rule help

Quoting "Jefferson, Shawn" <Shawn.Jefferson at ...14448...>:


> My original rule worked out great, but I tried to create another  
> rule that alerts me on anything that went from the $HOME_NET to  
> $EXTERNAL_NET port 11830, and I obviously did something wrong, since  
> I got about 3 million alerts in 5 minutes... pretty much all traffic  
> going to the IDS sensor (which takes forever to delete via BASE!)
>
> Here's what tried:
>
> alert ip $HOME_NET any -> $EXTERNAL_NET 11830 (msg:"port 11830  
> traffic outbound"; sid:1000002; rev:1;)

Change the "ip" to tcp.  IP protocol ignores the src and dest port  
numbers.  So yes, this rule is catching *any* outbound traffic.

jp


-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com





More information about the Snort-users mailing list