Snort mailing list archives
Re: Snort and matching window size?
From: James Lay <slave_tothe_box () yahoo com>
Date: Mon, 30 Jun 2003 09:39:17 -0600
On Mon, 30 Jun 2003 11:23:01 -0400 "Matt Kettler" <mkettler () evi-inc com> wrote:
At 07:21 AM 6/30/2003 -0600, James Lay wrote:alert tcp $EXTERNAL_NET any -> $HOME_NET 6588 (msg:"AnalogX Proxy Server Scan"; flags:S;) as my rule, but I'd like to know if there's a way to match the window size. I tried matchine it with a content matching keyword, but that didn't work. Does the content keyword match just the data portion of the packet? Or does it content match against headers as well? Thanks all! JamesContent matches the data only. There is however an option to check the tcp window size directly, although it's not in the formal documentation... Quoting Brian <bmc () snort org> from the snort-sigs list on 6/12/03:Snort has support for checking the window size. It has been an undocumented feature for the last 2 years. window:[!]<window_size>;
JUST what the doctor ordered...I'm hoping the data is givin in decimal and not hex...but I'll try both. Any other undocumented features out there? Thanks! James ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort and matching window size? James Lay (Jun 30)
- Re: Snort and matching window size? Matt Kettler (Jun 30)
- Re: Snort and matching window size? James Lay (Jun 30)
- Re: Snort and matching window size? Chris Green (Jun 30)
- Re: Snort and matching window size? James Lay (Jun 30)
- Re: Snort and matching window size? Matt Kettler (Jun 30)