No subject


Thu Nov 23 16:36:19 EST 2017


to 192.168.5.1 only with log, the others component of 192.168.1.0/24 must
generate an alert... wich rule I must create?


2) Second Doubt (Established Connections)

I protect my host with snort, so I've done this rule

alert tcp HOST-B any -> HOST-A any (msg: "connection attempted";)

when HOST-A connect to HOST-B:139 for netbios share, the HOST-B response the
connection for establishing it, and snort generate an alert from it... I
need only snort to log HOST-B attemp to HOST-A not, just established
connection and data transfer.

How to solve this problem ?




More information about the Snort-users mailing list