Snort mailing list archives
Re: ru.le to detect lots of syn pkts?
From: Paul Schmehl <pauls () utdallas edu>
Date: Fri, 04 Jun 2004 16:57:04 -0500
--On Friday, June 04, 2004 11:36:54 AM -0600 Rich Adamson <radamson () routers com> wrote:
No, something else is wrong. Thresholding has been in snort since about 2.0.4 (IIRC). It may be a syntax problem. Make sure that you have a colon after threshold and commas after each keyword, and a semi-colon at the end.> Of course. That's what thresholding is for. For example: > > If you only want to catch SYN packets: > alert tcp $HOME)NET any -> any any (msg: "High traffic host, SYN > packets"; flags:S; threshold: type both, track by_src, count 4000, > seconds 60; classtype:misc-activity; sid: 1000002; rev:1;)Getting and error "*** Invalid integer input: 4000" using the above. Running v2.10. Do I need to upgrade to handle this?
threshold: type both, track by_src, count 4000, seconds 60; Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/ir/security/ ------------------------------------------------------- This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and evaluate today! http://www.installshield.com/Dev2Dev/0504 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)
- Re: ru.le to detect lots of syn pkts? AJ Butcher, Information Systems and Computing (Jun 04)
- Re: ru.le to detect lots of syn pkts? Paul Schmehl (Jun 04)
- Re: ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)
- Re: ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)
- Re: ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)
- Re: ru.le to detect lots of syn pkts? Matt Kettler (Jun 04)
- <Possible follow-ups>
- Re: ru.le to detect lots of syn pkts? Paul Schmehl (Jun 04)
- Re: ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)
- Re: ru.le to detect lots of syn pkts? Paul Schmehl (Jun 04)
- Re: ru.le to detect lots of syn pkts? Rich Adamson (Jun 04)