Thresholding

[Erwin Van de Velde <erwin.vandevelde () ua ac be>]

Hi,

Is it possible to make a threshold that does per-source checking? I don't know 
if this is the right English termniology, so I'll tell what I really want to 
say :-)
Let's say you have a SSH server, and you would like to block an IP if more 
than 5 login attempts (TCP-SYN packets to port 22) come from that IP in a 
minute. On the other hand, it's a busy server, so 5 login attempts from 
different locations (IP addresses thus) in one minute should be possible.

Can I do this with thresholding? How? And if it is not possible... are there 
other ways to get this done?

Thanks in advance,
Erwin



-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive?  Does it
help you create better code?  SHARE THE LOVE, and help us help
YOU!  Click Here: http://sourceforge.net/donate/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users