Re: Activates/Dynamic

["Keith W. McCammon" <mccammon () gmail com>]

> Are Activate/Dynamic rules still supported in the more recent releases of Snort?

I think they're still there, but I believe they're on their way out.  
 
> For the curious ones, here is what i am trying to achieve:
>
> Occasionally, during some really wierd hours, the CPU utilization on
> one of my routers spikes to 70% or higher.  I know it's because of a
> sudden spike in network traffic, but i don't know what the traffic is.
>  I send snmp queries to the router which responds with the cpu
> utilization.  I am using byte_test to check the value of the cpu
> utilization and I'd like to activate the dynamic portion if the
> utilization is above 40%. The dynamic rule would capture a million or
> so packets.
>
> [snip]
>
> I don't think i can do this with tagging because i am trying to
> capture ALL traffic, not just between the two hosts that generated the
> original event.
>
> Any ideas?

Yep.  Start with NTop.  Let that puppy run and gather some
higher-level data.  Then, if you still want packet-level data, you can
start crafting rules to dump traffic between known offending hosts.

It seems like you're trying to wedge Snort into the solution, when
what you really need to know is who's talking, using what protocols
and services, and when.  NTop is very well-suited to do this--better
so than your IDS.


-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users