I am a newbie

[Fabien Delmotte <fdelmotte1 () mac com>]

Hello

I am using snort 2.9.2.2

I am trying to setup a rule for UDP flow
# DOS-UDP Flooding Attack RULE
#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"UDP_Flood Attack!!!!!"; threshold:type threshold, track by_src, 
count 3, seconds 20; sid:1000001; rev:1;)

alert udp any any -> any any (msg:"UDP_Flood Attack!!!!!";sid:1000001;)

#alert icmp any any -> anyT any (msg:"ICMP testing"; sid:10000001;)

I am sending UDP packet (I done a TCPDUMP)

I also removed all the rule in the snort.conf file, I just let my rule :)

Any comment ?

Regards

Fabien

------------------------------------------------------------------------------
Rapidly troubleshoot problems before they affect your business. Most IT 
organizations don't have a clear picture of how application performance 
affects their revenue. With AppDynamics, you get 100% visibility into your 
Java,.NET, & PHP application. Start your 15-day FREE TRIAL of AppDynamics Pro!
http://pubads.g.doubleclick.net/gampad/clk?id=84349831&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!