RE: Catchall Rule

["John Cherbini" <cherbini () ecom arizona edu>]

Never mind everyone.....

After a few more searches...I found this.

http://www.mcabee.org/lists/snort-users/Jun-01/msg00419.html

Sorry for the confusion!

Thanks!

John C.

>  -----Original Message-----
> From:         John Cherbini [mailto:cherbini () dakotacom net] 
> Sent: Wednesday, February 05, 2003 8:40 PM
> To:   'Snort User Groups'
> Subject:      Catchall Rule
>
> Hello everyone.....
>
> We're working on a project, where as a part of it, we would 
> like to use snort to add *every* packet it reads in a file to the DB.
>
> I've got the command line down, but I'd like to check on a 
> rule that will set *every* packet to generate a flag.
>
> After looking through this doc....
>
> http://www.snort.org/docs/writing_rules/chap2.html
>
> I'm thinking something like this:
>
> Alert tcp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
> Alert udp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
> Alert icmp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
>
> My concern is the third "any".....not sure if that will work.
>
> Does anyone have any input on this?
>
> I'd appreciate any advice!
>
> Thanks!
>
> John Cherbini