Snort mailing list archives
Snort Rules
From: mosquitooth () gmx net
Date: Thu, 23 Dec 2004 20:23:13 +0100 (MET)
Hi, I'm quite a newbie on snort, so please excuse my basic questions: The following describes the way I understand the behaviour and use of snort rules in the inernal system. Please comment on this (and correct me :~)). First of all, snort divides all rules in (at least) 4 parts, based on protocol (TCP/UDP/ICMP/IP). Now, there's a RuleTreeNode (RTN) for every type of - let's say TCP - rule 'below' the main protocol list (rules that have identical src/dest ips AND identical min/max src ports are combined, so you can check several rules in one time). This RTN contains rule information, esp. two linked lists for source and destination IP addresses and min/max- src/dest port (along with some flags and other stuff, necessary to check if the current packet belongs to this rule group). Additionally, a linked list with the rule-specific barebones exits (OptTreeNode = OPT). Here you can find the rules metadata and some keywords (statefule inspection). And that's exactly the point where I'm hampered. AFAIK you should find here e.g. the content to search for, in short: every rule-specific information that cannot be used to create deeper groups. But there is none! So, could anyone tell me first, whether the above statements are correct, second if this also applies to the new rule engine in snort 2.x and third how the system continues at the point where I'm stucked. Now, I excuse for my bad english and whish you all 'Merry Christmas' Peter P.S.: Just to mention, why does snort fire several alerts per packet? Shouldn't be one enough? -- +++ Sparen Sie mit GMX DSL +++ http://www.gmx.net/de/go/dsl AKTION für Wechsler: DSL-Tarife ab 3,99 EUR/Monat + Startguthaben ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort Rules mosquitooth (Dec 23)