[Snort-users] Dealing with Snort rules and signatures

Joel Esler jesler at ...1935...
Fri Aug 3 17:40:33 EDT 2012

On Jul 27, 2012, at 7:21 AM, Pratik Narang <pratik.cse.bits at ...11827...> wrote:

> As and when Snort sees packets, how it deals with them? I read in the
> manual- "The Pass rules are applied first, then the Drop rules, then
> the Alert rules and finally, Log rules are applied" and "the event
> processing is terminated when a pass rule is encountered".
> So, will all pass rules be *always* applied to a packet?

If the rule matches and the action is pass, then pass action is taken before a drop.  So, yes, the packet will be allowed through.

> Snort rules are huge in number. For the sake of higher efficiency, how
> can I customize Snort to do, say, that 'after you see that such-n-such
> packet(s) triggers such-n-such rule(s), take <this> action on it/
> apply no more rules on it'.

Depends on what you are trying to do, that's a very open question.

> How does Snort deal with encrypted packets? How does it deal with
> packets on SSL, and packets on TCP & TLS?

At Sourcefire, we sell an SSL offloader which decrypts packets and sends them into the IPS (Snort) for analyzation.  Snort doesn't have much native SSL handling other than to detect SSL sessions being setup, if they are good or bad, and if they are set up, to ignore the rest of the session from inspection (as it is encrypted)

> How does it deal with compressed (zipped) packets? Can signatures be
> applied to them without loss of efficiency?

It can decompress and inspect the traffic if you use the file_data Snort rule keyword.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120803/b2aa6ac4/attachment.html>

More information about the Snort-users mailing list