Snort mailing list archives
About detection fileter
From: Ryota Kurokawa <r-kurokw () ist osaka-u ac jp>
Date: Tue, 14 Nov 2017 21:28:18 +0900
Hi I am using Snort 2.9. I have written the following rules. - - alert icmp 192.168.37.231 any -> 192.168.37.236 any(msg: "ICMP traffic once a second"; detection_filter: track by_src, count 10,
seconds 1; classtype: attempted-dos; priority: 1; sid: 1000001;) - -In the above rule, it detects that it receives 10 packets a second. This rule succeeded.
I have one question. For example, what happens if I receive a packet 15 times per second? Is the remaining 5 ignored? Or will it count in the next second? Thanks. _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- About detection fileter Ryota Kurokawa (Nov 14)