Snort mailing list archives
Re: real-time alerting and rule to monitor only specific traffic
From: Y M <snort () outlook com>
Date: Thu, 26 Feb 2015 19:25:28 +0000
The ":" is used for specifying port ranges, so in your log rule you are basically negating all ports from 80 all the way to 443. You may be want to do something like ![80,443] to specify two individual ports, plus negation. If you want to completely not inspect destination TCP on ports 80 and 443, then BPF is the way to go. From: lokanovic () flightapps com To: allewi () cisco com; snort-users () lists sourceforge net Date: Thu, 26 Feb 2015 18:24:24 +0000 Subject: Re: [Snort-users] real-time alerting and rule to monitor only specific traffic Does this look correct if i'm trying to exclude traffic on port 80 and 443 from being logged? alert tcp any any -> any any (msg:"TCP testing rule";sid:1000001;) log tcp any any -> 10.0.90.0/24 !80:443 This is from my local rules file. Thank you, Lena Okanovic lokanovic () flightapps com From: Al Lewis (allewi) <allewi () cisco com> Sent: Monday, February 23, 2015 5:45 PM To: Lena Okanovic; snort-users () lists sourceforge net Subject: RE: [Snort-users] real-time alerting and rule to monitor only specific traffic You can filter that out by applying a bpf filter to the end of your command. Below I filtered out port 80 traffic. Without the filter I get alerts but with the filter I don’t even though the rule is “any to any” inside the conf file. gecko:/var/tmp/snort-2.9.7.0-released # ./bin/snort -c etc/lena.conf -r etc/lena.pcap -A console:test -H -U -k none -q 1 1 1000001 0 2 1 1000001 0 3 1 1000001 0 gecko:/var/tmp/snort-2.9.7.0-released # ./bin/snort -c etc/lena.conf -r etc/lena.pcap -A console:test -H -U -k none -q not tcp port 80 gecko:/var/tmp/snort-2.9.7.0-released # gecko:/var/tmp/snort-2.9.7.0-released # tcpdump -n -r etc/lena.pcap -c 1 reading from file etc/lena.pcap, link-type EN10MB (Ethernet) 11:11:28.852742 IP 10.5.40.95.36884 > 10.4.31.42.80: Flags [S], seq 2514493807, win 5840, options [mss 1460,sackOK,TS val 347823238 ecr 0,nop,wscale 7], length 0 gecko:/var/tmp/snort-2.9.7.0-released # For the email alerts you can try sending messages to syslog and then emailing from there. Maybe someone else can chime in and help out with that. Hope this helps! Albert Lewis QA Software Engineer SOURCEfire, Inc. now part of Cisco 9780 Patuxent Woods Drive Columbia, MD 21046 Phone: (office) 443.430.7112 Email: allewi () cisco com From: Lena Okanovic [mailto:lokanovic () flightapps com] Sent: Monday, February 23, 2015 7:25 PM To: snort-users () lists sourceforge net Subject: [Snort-users] real-time alerting and rule to monitor only specific traffic Hello, How can I only monitor TCP traffic that is not on port 80 or 443 or on our DMZ IP address? And also, can someone please provide me with instructions on how to setup real-time (email) alerting in Snort on Windows server box. So, if 'bad' TCP traffic comes through, I would like to get an email right a way letting me know. Thank you, Lena Okanovic lokanovic () flightapps com ------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- real-time alerting and rule to monitor only specific traffic Lena Okanovic (Feb 23)
- Re: real-time alerting and rule to monitor only specific traffic Al Lewis (allewi) (Feb 23)
- Re: real-time alerting and rule to monitor only specific traffic Lena Okanovic (Feb 26)
- Re: real-time alerting and rule to monitor only specific traffic Y M (Feb 26)
- Re: real-time alerting and rule to monitor only specific traffic Lena Okanovic (Feb 26)
- Re: real-time alerting and rule to monitor only specific traffic Al Lewis (allewi) (Feb 23)