RE: Catchall Rule

["John Cherbini" <cherbini () dakotacom net>]

Rodney......
 
I'm using snortagent......so my config file is in
/opt/snortagent/sensor/rules/snort.eth0.conf
 
I just modify this file to log to the correct DB, with the correct UN
and PW.......and then run this command line.  (your path may vary)
 
snort -r ../../mit_data/outside.tcpdump -c
/opt/snortagent/sensor/rules/snort.eth0.conf
 
You could set up multiple config files...etc.....but this is working for
me at the moment.
 
JC

-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net] On Behalf Of Rodney
Green
Sent: Thursday, February 06, 2003 7:40 AM
To: John Cherbini; 'Snort User Groups'
Subject: Re: [Snort-users] Catchall Rule


John,
 
How do you get the data captured by those rules into the DB? I'd like
to play around with doing that.
 
Thanks,
Rod

----- Original Message ----- 
From: John  <mailto:cherbini () dakotacom net> Cherbini 
To: 'Snort User Groups' <mailto:snort-users () lists sourceforge net>  
Sent: Wednesday, February 05, 2003 11:28 PM
Subject: RE: [Snort-users] Catchall Rule


We wanted to have them all logged into a DB, and most importantly,
parsed!  And we didn't feel like writing our own parser.

I've got it figured out though......with these rules 

######CATCHALL RULES######## 
alert tcp any any -> any any (msg: \"tcp traffic\";) 
alert udp any any -> any any (msg: \"udp traffic\";) 
alert icmp any any -> any any (msg: \"icmp traffic\";) 
############################ 

John C. 

> -----Original Message----- 
> From: Jacob Redding [ <mailto:dextor () WiredGeek com>
mailto:dextor () WiredGeek com] 
> Sent: Wednesday, February 05, 2003 9:18 PM 
> To: John Cherbini 
> Cc: 'Snort User Groups' 
> Subject: Re: [Snort-users] Catchall Rule 
>
>
>   Why not just use tcpdump?? 
>
> -Jacob 
>
> On Wed, 5 Feb 2003, John Cherbini wrote: 
>
> > Hello everyone... 
> >
> > We're working on a project, where as a part of it, we would like to 
> > use snort to add *every* packet it reads in a file to the DB. 
> >
> > I've got the command line down, but I'd like to check on a 
> rule that 
> > will set *every* packet to generate a flag. 
> >
> > After looking through this doc.. 
> >
> >  <http://www.snort.org/docs/writing_rules/chap2.html>
http://www.snort.org/docs/writing_rules/chap2.html 
> > I'm thinking something like this: 
> >
> > Alert tcp any any -> any (content:"|45 00|"; msg: "Catchall Rule";) 
> > Alert udp any any -> any (content:"|45 00|"; msg: "Catchall Rule";) 
> > Alert icmp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)

> > My concern is the third "any"...not sure if that will work. 
> >
> > Does anyone have any input on this? 
> >
> > I'd appreciate any advice! 
> >
> > Thanks! 
> >
> > John Cherbini