Snort mailing list archives
RE: Help with Rules
From: "Basselgia, Barry A Mr (NAF Atsugi)" <BABasselgia () atsugi navy mil>
Date: Fri, 1 Apr 2005 09:20:20 +0900
Have you checked out the bleeding edge rules at www.bleedingsnort.com, they have a very good collection of virus, spyware, adware rules. Barry -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Kevin Smith Sent: Friday, April 01, 2005 3:13 AM To: Briggs, Bruce; snort-users () lists sourceforge net Subject: [Snort-users] Help with Rules Hey Bruce, Here is the rule I have been messing around with. alert tcp $NETWORK any -> any any (tag:session,600,seconds;) I have also tried alert tcp $NETWORK any -> any any (tag:host,100,packets,src;) Where network is defined as: var NETWORK [64.7.160.0/19] Mainly, the rules are logging the correct information. The problem is I am just receiveing way to much information to handle. I have a php script that is going through the information and sending e-mails to our support staff to let them know of any possible problems (such as spy-ware, viruses, etc) to the end user. he problem is that the database will get up to 100,000 records and when the script runs and removes the old information for a customer who isn't online any more it will take forever to remove the information and the system's resources just max out. If the information is low, in the thousands, it runs fine. So I would like to get a handle of the packets and log them, versus everyone that comes across the interface. I thought tag would do that, but I am guessing it is not. Any ideas? Thanks, Kevin ------------------------------------------------------- This SF.net email is sponsored by Demarc: A global provider of Threat Management Solutions. Download our HomeAdmin security software for free today! http://www.demarc.com/info/Sentarus/hamr30 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- This SF.net email is sponsored by Demarc: A global provider of Threat Management Solutions. Download our HomeAdmin security software for free today! http://www.demarc.com/info/Sentarus/hamr30 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: Help with Rules Basselgia, Barry A Mr (NAF Atsugi) (Mar 31)