Re: Catchall Rule

[Jacob Redding <dextor () WiredGeek com>]

  Why not just use tcpdump??

-Jacob

On Wed, 5 Feb 2003, John Cherbini wrote:

> Hello everyone...
>
> We're working on a project, where as a part of it, we would like to use
> snort to add *every* packet it reads in a file to the DB.
>
> I've got the command line down, but I'd like to check on a rule that
> will set *every* packet to generate a flag.
>
> After looking through this doc..
>
> http://www.snort.org/docs/writing_rules/chap2.html
>
> I'm thinking something like this:
>
> Alert tcp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
> Alert udp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
> Alert icmp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
>
> My concern is the third "any"...not sure if that will work.
>
> Does anyone have any input on this?
>
> I'd appreciate any advice!
>
> Thanks!
>
> John Cherbini


-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users