RE: Catchall Rule

["John Cherbini" <cherbini () dakotacom net>]

We wanted to have them all logged into a DB, and most importantly,
parsed!  And we didn't feel like writing our own parser.

I've got it figured out though......with these rules

######CATCHALL RULES########
alert tcp any any -> any any (msg: \"tcp traffic\";)
alert udp any any -> any any (msg: \"udp traffic\";)
alert icmp any any -> any any (msg: \"icmp traffic\";)
############################

John C.

> -----Original Message-----
> From: Jacob Redding [mailto:dextor () WiredGeek com]
> Sent: Wednesday, February 05, 2003 9:18 PM
> To: John Cherbini
> Cc: 'Snort User Groups'
> Subject: Re: [Snort-users] Catchall Rule
>
>
>   Why not just use tcpdump??
>
> -Jacob
>
> On Wed, 5 Feb 2003, John Cherbini wrote:
>
> > Hello everyone...
> >
> > We're working on a project, where as a part of it, we would like to
> > use snort to add *every* packet it reads in a file to the DB.
> >
> > I've got the command line down, but I'd like to check on a
> rule that
> > will set *every* packet to generate a flag.
> >
> > After looking through this doc..
> >
> > http://www.snort.org/docs/writing_rules/chap2.html
> >
> > I'm thinking something like this:
> >
> > Alert tcp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
> > Alert udp any any -> any (content:"|45 00|"; msg: "Catchall Rule";) 
> > Alert icmp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
> >
> > My concern is the third "any"...not sure if that will work.
> >
> > Does anyone have any input on this?
> >
> > I'd appreciate any advice!
> >
> > Thanks!
> >
> > John Cherbini