Re: Catchall Rule

[twig les <twigles () yahoo com>]

Well if I break out my dusty TCP/IP skills it seems that those three rules would miss any packets
that have TCP options since the 5 in |45 00| equates to a 20-byte header.  But since I've had a
string of stupid mistakes in the last week anyone can correct me.  :)

What I'm wondering even more though is why you don't just write a rule based on IP instead of the
3 protocols that are embedded in IP.  Of course curiosity forces me to ask why you are using snort
to cram everything into a database too.

--- John Cherbini <cherbini () dakotacom net> wrote:
> Hello everyone...
>
> We're working on a project, where as a part of it, we would like to use
> snort to add *every* packet it reads in a file to the DB.
>
> I've got the command line down, but I'd like to check on a rule that
> will set *every* packet to generate a flag.
>
> After looking through this doc..
>
> http://www.snort.org/docs/writing_rules/chap2.html
>
> I'm thinking something like this:
>
> Alert tcp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
> Alert udp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
> Alert icmp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
>
> My concern is the third "any"...not sure if that will work.
>
> Does anyone have any input on this?
>
> I'd appreciate any advice!
>
> Thanks!
>
> John Cherbini


=====
-----------------------------------------------------------
Know yourself and know your enemy and you will never fear defeat.         
-----------------------------------------------------------

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com


-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users