Snort mailing list archives
Re: logging abnormal traffic
From: "Paul Melson" <pmelson () gmail com>
Date: Wed, 16 Jan 2008 07:14:26 -0500
On Jan 16, 2008 5:30 AM, Wim Fournier <hsmade () gmail com> wrote:
Hi all, I'm a newbie on this product, so please excuse me for asking stupid questions ;o) I want to monitor traffic to a our web servers. The traffic is very well and easy defined. A definition would look like: client requests /some/dir/file?param=value¶m2=value2&....etc Server responds with 200 OK and a GIF picture or a 302 Now I want to log anything that does not match this, as in web requests that don't match this pattern and other requests than GET. Is there an easy way to do this? Like first defining the accepted traffic and logging anything else? Thanks for any clues, pointers, whatever
If you can easily define appropriate traffic to your webserver with a couple of regex expressions, then you could write some pass rules for the known-good pcre patterns and then write an alert rule that matched on any connection to the web server. This should result in only things that don't match your pattern being alerted on by Snort. More on rules here: http://www.snort.org/docs/snort_htmanuals/htmanual_280/node163.html PaulM ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- logging abnormal traffic Wim Fournier (Jan 16)
- Re: logging abnormal traffic Paul Melson (Jan 16)
- Re: logging abnormal traffic Wim Fournier (Jan 16)
- Re: logging abnormal traffic Paul Melson (Jan 16)