Snort mailing list archives
SYN flood detection
From: Pawel Rogocz <pawel () rogocz com>
Date: Fri, 10 May 2002 03:57:07 -0700
I was really surprised to find out snort does not detect syn floods. Checking spp_portscan.c it looks like a small change should take care of the problem. I am attaching a diff against 1.8.6. It works for me, YMMV :-) Pawel *** spp_portscan.old Fri May 10 03:27:39 2002 --- spp_portscan.c Fri May 10 03:39:03 2002 *************** *** 666,672 **** if(currentConnection == NULL) FatalError(MODNAME ": currentConnection is NULL!!!??\n"); ! if((currentConnection->dport == dport) && (currentConnection->scanType == scanType)) { /* * If the same exact connection already exists, --- 666,672 ---- if(currentConnection == NULL) FatalError(MODNAME ": currentConnection is NULL!!!??\n"); ! if((currentConnection->sport == sport) && (currentConnection->dport == dport) && (currentConnection->scanType == scanType)) { /* * If the same exact connection already exists, -- _______________________________________________________________ Have big pipes? SourceForge.net is looking for download mirrors. We supply the hardware. You get the recognition. Email Us: bandwidth () sourceforge net _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- SYN flood detection Pawel Rogocz (May 10)
- Re: SYN flood detection Matt Kettler (May 10)
- Re: SYN flood detection Erek Adams (May 10)
- Re: SYN flood detection Pawel Rogocz (May 10)
- Re: SYN flood detection Erek Adams (May 10)
- Re: SYN flood detection Erek Adams (May 10)
- Re: SYN flood detection Matt Kettler (May 10)