[Snort-users] Specific rule for bandwidth

Davis McPherson (davmcphe) davmcphe at ...589...
Tue Sep 15 10:46:37 EDT 2015

The stream size option is evaluated on packets when a rule is evaluated.  The current stream size is computed by subtracting the current 'next seq' from the ISN (or vice-versa to handle wrapping).  The value is computed for the server and client directions and then comparison is done for the directions specified by the rule against the threshold value in the rule using the comparison operator defined by the rule.   There is no reset if the rule is triggered, so the stream size is a count of the number of bytes observed on the stream.

-davis mcpherson

-------- Forwarded Message --------
Subject:        [Snort-users] Specific rule for bandwidth
Date:   Tue, 15 Sep 2015 07:24:11 +0000
From:   Gabriel Corre <gabriel.corre at ...17281...><mailto:gabriel.corre at ...391...7281...>
To:     snort-users at lists.sourceforge.net<mailto:snort-users at ...2987...rge.net> <snort-users at lists.sourceforge.net><mailto:snort-users at ...635...eforge.net>


I would like to use “stream_size” as a bandwidth controller. Thus I created this rule to test its functionality:
alert tcp EXTERNAL_NET any -> HOME_NET any (msg:"WARNING! Session bandwidth > 8 bytes"; stream_size:both,>,8"; sid:1000000001;)
I would like to know if “stream_size” is reset when the alert is triggered or it still count the number of bytes observed?

The doc says : “The stream size keyword allows a rule to match traffic according to the number of bytes observed, as determined by
the TCP sequence numbers.” It doesn’t pinpoint this aspect and I’m not about my bandwidth test.



Gabriel Corré
Élève Ingénieur Sécurité & Réseaux, Ops - Core Infrastructure

More information about the Snort-users mailing list