Snort mailing list archives
tell the number of packets before triggering
From: Marius Stefan <mars () relay1 shutdown ro>
Date: Wed, 05 Mar 2003 19:03:12 +0200
hi.aside the standard signatures, snort misses the kind of alert that triggers after a customizable number of packets. let's say i do "ping -f". well, snort doesn't see it. i wish i could make an alert icmp that can be triggered after 100pps. this goes for the tcp as well, i can split the alerts into "normal" and "aggressive" from the number of packtes per second. if snort cannot do it,
what's the alternative? thanks. Marius -------------------------------------------------------This SF.net email is sponsored by: Etnus, makers of TotalView, The debugger for complex code. Debugging C/C++ programs can leave you feeling lost and disoriented. TotalView can help you find your way. Available on major UNIX and Linux platforms. Try it free. www.etnus.com
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- tell the number of packets before triggering Marius Stefan (Mar 05)