Re: Using snort as connection tracker

[sekure <sekure () gmail com>]

If this was TCP traffic, then it'd be easy....  With UDP it's a little
difficult.  See if you can find something in the payload to identify a
session start for the application itself.  Otherwise, you can play
around with thresholding, track by source and log one every 15
minutes, or every half hour, or whatever.  The problem here is that
you might miss some new connections that occur within that time
window.

Your best bet is to look in the application level for some identifying
information.  Ethereal is your friend.



On Sun, 19 Dec 2004 16:15:25 +0100, Klemen Mihevc <mafia-x () volja net> wrote:
> Hello,
>
>  
>
> I'm kinda new in »advanced« snort configuration. Until now i only used it
> with »default« cfg & rules. Now i have a problem, I'm runing on linux server
> 2 gameservers on udp port 27960 & 28960 i made 2 custom rules to track that
> connections:
>
>  
>
> alert udp $EXTERNAL_NET any -> $HOME_NET 27960 (msg:"Enemy Territory
> player";)
>
>  
>
> alert udp $EXTERNAL_NET any -> $HOME_NET 28960 (msg:"Call of Duty player";)
>
>  
>
>  
>
> now i have a problem couse every packet is logged (and logs are huge) even
> if it's only about 1k big and it is product of outside scan of server not
> actual connection to it. Is there anyway to log only first and last package
> from 1 ip and only if data transfer is bigger then let's say 5k? Or maybe
> anyother way to log that connections? I also tryed with chaosreader &
> tcpdump but this method is too much cpu & ram consuming and i also tried
> with iptable but again with same problem (every package is logged). I relay
> wanna use snort because i can use mysql & acid for statistic...
>
>  
>
>  
>
> Thx
>
>  
>
>  
>
> PS: sorry for my bad english ;)


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users