Re: test a threshold rule, please?

[Rich Adamson <radamson () routers com>]

Apparently the problem was a Win32 specifc issue that Chris rsolved. He sent a
private email with an executable that addressed the issue, and its now working
just fine. The seconds and count parameters in the example were intended to 
generate some sample alerts, which it did following the fix. I've since increased
those thresholds to realistic numbers. :)

Rich

------------------------

> Rich,
>
> I don't know if this is one of those "better late than never"
> situations, but I was looking through the archive for something
> resembling your rule below to detect high rates of SYNs and just
> wanted to let you know that this rule, with a few small modifications
> (i changed the count to 25 and seconds to 1) does not cause ANY
> problems in Snort 2.2.0RC1 running on Linux.
>
>
> On Tue,  6 Jul 2004 08:41:00 -0600, Rich Adamson <radamson () routers com> wrote:
> > Could someone test the following rule in either linux or win32, please?
> >
> > alert tcp $HOME_NET any -> any any (msg: "High SYN Traffic"; flags:S; threshold: type
> > threshold, track by_src, seconds 60, count 1; classtype:misc-activity; sid: 1000002;
> > rev:1;)
> >
> > I'm trying to determine whether the above might indicate be a bug in
> > linux, win32, or syntax error on my part. If I try the above rule in win32
> > (v2.2.0rc1 build 28), snort will not start due to an integer error reading
> > the rule. Inserting  content:" "; offset:0; in the above allows snort to
> > start.
> >
> > Any help/suggestions would be greatly appreciated. Off-list comments are
> > fine if you'd like.
> >
> > Rich
> >
> > -------------------------------------------------------
> > This SF.Net email sponsored by Black Hat Briefings & Training.
> > Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> > digital self defense, top technical experts, no vendor pitches,
> > unmatched networking opportunities. Visit www.blackhat.com
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users

---------------End of Original Message-----------------




-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users