Snort mailing list archives
Re: download size limit
From: Matt Kettler <mkettler () evi-inc com>
Date: Tue, 18 Jan 2005 16:54:32 -0500
At 01:11 PM 1/18/2005, Gentian Hila wrote:
I was wondering if snort can detected when a user (internally) uses more than a certain bandwidth for downloading (i.e. 2 Mb) Is there an automatic rule to do that ? Or do I need to write my own rule to do that ? Is it possible at all ? I am very new at Snort so please forgive if that's not something snort does at all
That's not something snort does at all. Snort's designed to look for particular contents in network packets, or tcp streams, but it's usual "window of inspection" is no more than 64kb.
You might be able to hack something up with thresholding with a rule that triggers on any packet over 1000 bytes, but it would be kludgy and inaccurate at best...
If you want to do bandwidth limiting, you might want to look at QoS features in various routers and/or firewalls (including opensource tools like IPTables)
------------------------------------------------------- The SF.Net email is sponsored by: Beat the post-holiday blues Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek. It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- download size limit Gentian Hila (Jan 19)
- Re: download size limit Matt Kettler (Jan 19)
- Re: download size limit Jose Maria Lopez (Jan 19)