[Snort-users] Alert on Max connections per IP

wkitty42 at ...14940... wkitty42 at ...14940...
Tue Jun 7 11:21:46 EDT 2016

On 06/06/2016 06:40 PM, Argcyborg wrote:
> Hi, if I use this rule, what be the threshold two config?
> alert tcp $EXTERNAL_NET any -> 4000 ( msg:"Deteccion de
> conexiones"; flow:established,to_server; content:"|0d 00 00 00 50 cc 5d ed
> b6 19 a5 91 00|"; nocase; rawbytes; detection_filter: track by_src, count 2,
> seconds 60; sid:1000050; rev:1;)

this rule fires if there are two connections from the same IP to the destination 
IP within sixty seconds... the detection_filter portion is the old in-rule 
thresholding... it was changed because there's also the threshold.conf file 
which can do similar... you cannot threshold.conf a rule with detection_filter 
in it... it is viewed as thresholding a thresholded rule and for some reason 
that's not allowed...

if you want the rule above to fire less often, then try increasing the count and 
seconds values...

> Thanks again!
> -----Mensaje original-----
> De: wkitty42 at ...14940... [mailto:wkitty42 at ...14940...]
> Enviado el: domingo, 5 de junio de 2016 20:41
> Para: snort-users at lists.sourceforge.net
> Asunto: Re: [Snort-users] Alert on Max connections per IP
> On 06/05/2016 05:39 PM, Argcyborg wrote:
>> Hi, is there a way to alert or drop when receive more than 8 connections
> per ip
>> to an specific port ?
> that's called thresholding...

  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

More information about the Snort-users mailing list