Snort mailing list archives
Re: Snort 1.9 flow keyword
From: Brian <bmc () snort org>
Date: Thu, 7 Nov 2002 09:41:53 -0500
On Tue, Oct 29, 2002 at 09:26:43AM -0800, shadi Rostami wrote:
Hello, What is the difference between to_client and from_server and to_server and from_client values for flow keyword.
To add to chris's comments, the reason there are duplicate flow keywords is to provide some context to the rules. Example 1: alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any \ (msg:"ATTACK RESPONSES http dir listing"; \ content: "Volume Serial Number"; \ flow:from_server,established; \ classtype:bad-unknown; sid:1292; rev:4;) In this rule, we look for "Volumne Serial Number" coming from our web server. In this rule, we are concerned about our web server, so I use the "from_server" option. Example 2: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any \ (msg:"WEB-CLIENT readme.eml autoload attempt"; \ flow:to_client,established; \ content:"window.open(\"readme.eml\""; nocase; \ classtype:attempted-user; sid:1290; \ reference:url,www.cert.org/advisories/CA-2001-26.html; \ rev:8;) In this rule, we look for "window.open(\"readme.eml\"" going towards our client. In this rule, we are concerned about our client, so I use the "to_client" option. -brian ------------------------------------------------------- This sf.net email is sponsored by: See the NEW Palm Tungsten T handheld. Power & Color in a compact size! http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0001en _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Portscan parameters shadi Rostami (Oct 01)
- Re: Portscan parameters Glenn Forbes Fleming Larratt (Oct 01)
- Snort 1.9 flow keyword shadi Rostami (Oct 29)
- Re: Snort 1.9 flow keyword Chris Green (Oct 29)
- Re: Snort 1.9 flow keyword Brian (Nov 07)