[Snort-users] Using a var in the conf and local rules
wkitty42 at ...14940...
Mon Feb 25 14:54:25 EST 2013
On 2/25/2013 12:51, honeybadger at ...15978... wrote:
> Hey all,
> I am adding scanners for 600+ suspect IPs in a text file.
> Ok adding in include snort.var
> Adding var IP_RULES
> Then tcp any any - > $IP_RULES any (msg:"suspect IP detected; sid 4525;)
> I would like if the alert would tell me which IP it found.
the alert report does tell that... at least for those that i've seen...
> Usually I would use a content but this is different.
> Any know how to set this up?
there's nothing to set up AFAIK... what are you using to detect the alerts??
here's a sample alert from the snort alert log so you can see what i'm saying
about the IP being in there...
[**] [1:2500034:2789] ET COMPROMISED Known Compromised or Hostile Host Traffic
TCP (18) [**]
[Classification: Misc Attack] [Priority: 2]
02/24-04:39:29.114306 < l/l len: 0 l/l type: 0x200 EC:B7:3E:F:0:0
pkt type:0x0 proto: 0x800 len:0x40
184.108.40.206:46258 -> XXX.XXX.XXX.XXX:80 TCP TTL:109 TOS:0x0 ID:9921 IpLen:20
******S* Seq: 0x78ABED36 Ack: 0x2F38F17D Win: 0xFFFF TcpLen: 28
TCP Options (4) => MSS: 1412 NOP NOP SackOK
[Xref => http://doc.emergingthreats.net/bin/view/Main/CompromisedHosts]
in this case, 220.127.116.11 is listed in the rule's IP list... i've redacted the
target server's IP...
the point being that everything you need to know is there except the actual
packet that caused the alert... that would be found else where in another "log
file"... note that this may not be accurate with unified logging... we use only
snort's default logging that is done when no output methods are defined...
More information about the Snort-users