[Snort-users] Help with a rule
akirk at ...1935...
Fri Mar 6 09:12:54 EST 2009
First of all, depending on just how much you want to log, going with "alert"
instead of "log" and skipping the "tag:session;" may be smart - it would be
easy to overload your IDS with this if it's not very powerful, or if it's
attempting to do anything else.
That said, the rule you'd want for a purpose like this - which I'm sure you
realize is only stopgap, since it's really the web app's job to be doing
logging like this - would look more like:
alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg"text mime type
detected in web traffic"; flow:established,from_server;
content:"Content-Type|3A| text/"; nocase;
classtype:web-application-activity; sid:1000001; rev:1;)
* $HTTP_PORTS is actually a default Snort variable, as opposed to $PORT_HTTP
* Since the Content-Type header will be present in things coming *from* the
web server, and not going to it, the direction is set properly now
* "flow:established,from_server"; will save Snort a lot of work looking at
packets that will never match, based on them being in the wrong part of the
* The "|3A|" in the content is necessary, because a colon in a content
clause will cause a syntax error
* Removed "http_header", since it's for client requests, and you're looking
for server responses
* Removed quotes from the classtype, as that's another fatal syntax error
Hope that helps.
On Thu, Mar 5, 2009 at 11:21 PM, Frank Knobbe <frank at ...9761...> wrote:
> On Thu, 2009-03-05 at 21:38 -0600, Paul Schmehl wrote:
> > > Logs al http packets that has a text/* mime type.
> > alert tcp $EXTERNAL_NET any -> $HOME_NET $PORT_HTTP (msg:"text mime type
> > detected in web traffic"; content:"Content-Type: text/"; http_header;
> > classtype:"web-application-activity"; sid:1000001; rev:1;)
> Does it capture all packets? Does it log? (Your rule alerts)
> Strictly speaking, you probably would want to use the following
> modifications for his specific need:
> log tcp any any -> any $PORT_HTTP (msg:"text mime type
> detected in web traffic"; content:"Content-Type: text/"; http_header;
> classtype:"web-application-activity"; sid:1000001; rev:1; tag:session;)
> Open Source Business Conference (OSBC), March 24-25, 2009, San Francisco,
> -OSBC tackles the biggest issue in open source: Open Sourcing the
> -Strategies to boost innovation and cut costs with open source
> -Receive a $600 discount off the registration fee with the source code:
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive:
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users