Re: Filter SYN ACK

[Matt Kettler <mkettler () evi-inc com>]

I assume you're writing some semi-custom snort rules to do what you need.

If that is the case, use the 'flags' rule feature. Adding "flags: A+" will 
cause rules to match tcp packets which have the ack bit set, but any other 
flags (which is probably what you want).

Based on the documentation  I think "flags: A!S!F+" should match any packet 
with the ack bit set, but no Syn-Ack or Fin-Ack packets. But I suspect 
"flags: A+" is probably better, this is what all the normal snort rules do.

As for only packets containing get/post, you might look at the uricontent 
rule option... I'm not too familiar with it, but it seems like it might do 
part of what you need.

At 11:04 PM 1/29/2002 -0500, Warrick FitzGerald wrote:
> Hi All,
>
> Im hoping you guys have a better idea than some very tedious ones that I
> have tried.
>
> I am trying to filter HTTP draffic, which is easy enough, but I would only
> like to capture packets that contain application layer data ie. a GET or
> POST etc. does anyone know an easy way / basic filter than can do this for
> me ?
>
> Thanks
> Warrick
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users