Thu Nov 23 16:36:19 EST 2017
to 192.168.5.1 only with log, the others component of 192.168.1.0/24 must
generate an alert... wich rule I must create?
2) Second Doubt (Established Connections)
I protect my host with snort, so I've done this rule
alert tcp HOST-B any -> HOST-A any (msg: "connection attempted";)
when HOST-A connect to HOST-B:139 for netbios share, the HOST-B response the
connection for establishing it, and snort generate an alert from it... I
need only snort to log HOST-B attemp to HOST-A not, just established
connection and data transfer.
How to solve this problem ?
More information about the Snort-users