[Snort-users] Attribute Table question

SnortFan SnortFan at ...131...
Thu Nov 14 11:07:07 EST 2013


Hi All,
     I've got a question regarding the attribute table feature of snort. 

I work at a company where the group (mine) that is responsible for running the snort sensors is not the group that administers the network and servers we monitor. In fact each department has their open IT shop and we are tasked to monitor traffic between departments, coming in and going out of the company. We have not been using the attribute table feature in snort.  We want to see alerts on all traffic regardless on type and we don't know what IP is hosting what service. It looks like using the attributes table would make rules that don't fit it's expected protocol type to be ignored. 

One of the departments is now putting in a commercial source fire product and wants our custom rules with metadata: service tags to monitor their internal traffic.

1. In our situation where we don't control the ever changing IP space we monitor would using the attributes table feature be even possible or helpful?

2. Would adding the "metadata: service " tags to our rules break anything if we don't have any entries in the attribute table?

3. Am I totally miss understanding what the attribute table does?

Thanks,
Ed



More information about the Snort-users mailing list