Snort mailing list archives
(no subject)
From: "Carmit Partoush" <carmit () securenet co il>
Date: Tue, 11 Feb 2003 21:37:33 +0200
Hello all, I am using snort, I want to verify that in one telnet session, in one minute I will not received from the user more then 5 times the key "enter".('41') I want snort to close the session when I received the fifth enter request. That for I defined a rule : #alert tcp $HOME_NET any -> $EXTERNAL_NET 23 (msg:"TELNET login Type alarm alarm"; content:"|41|";) This rule recognized telnet request and the "enter" key ('41'). I want snort to reset the session that's way I am using : RESP_TCP_URG resp:rst_all; that's how I am closing the session. I have no idea how to tell the snort to use the rule that I defined only after I recognize 5 "enter" in one minute in one session. (now it close the session every time I am using telnet and "enter") any suggestion ??????? Carmit ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- (no subject) counterping (Jan 07)
- <Possible follow-ups>
- (no subject) counterping (Jan 07)
- (no subject) Jim Schwin (Jan 09)
- Re: (no subject) Erek Adams (Jan 09)
- (no subject) Michael Weiser (Jan 18)
- (no subject) Luiz Alberto Cataldo Jr (Jan 30)
- (no subject) Carmit Partoush (Feb 11)
- (no subject) Carmit Partoush (Feb 13)
- Re: (no subject) Erek Adams (Feb 13)
- (no subject) abhi naik (Feb 14)
- Re: (no subject) Charles Darwin (Feb 16)
- RE: (no subject) Michael Steele (Feb 16)
- (no subject) jcosta (Feb 27)
- Re: (no subject) Erek Adams (Feb 27)
- Re: (no subject) Erick Mechler (Feb 27)
- (no subject) Comcast (Mar 02)
- Re: (no subject) Erek Adams (Mar 03)
(Thread continues...)