Re: ru.le to detect lots of syn pkts?

[Rich Adamson <radamson () routers com>]

> > > > Of course.  That's what thresholding is for.  For example:
> > > >
> > > > If you only want to catch SYN packets:
> > > > alert tcp $HOME)NET any -> any any (msg: "High traffic host, SYN
> > > > packets";  flags:S; threshold: type both, track by_src, count 4000,
> > > > seconds 60;  classtype:misc-activity; sid: 1000002; rev:1;)
> >
> > Getting  and error "*** Invalid integer input: 4000" using the above.
> > Running v2.10. Do I need to upgrade to handle this?
> No, something else is wrong.  Thresholding has been in snort since about 
> 2.0.4 (IIRC).  It may be a syntax problem.  Make sure that you have a colon 
> after threshold and commas after each keyword, and a semi-colon at the end.
>
> threshold: type both, track by_src, count 4000, seconds 60;

Here's a copy/paste of the exact rule:
alert tcp $HOME_NET any -> any any (msg: "High SYN Traffic"; flags:S; threshold: track by_src, 
seconds 60, count 50, type both ; classtype:misc-activity; sid: 1000002; rev:1;)

Obviously we've moved the parameters around, but it still barfs on "seconds 60"
with the above order. I'm thinking this is a Win32 bug since upgrading to
the latest build did not resolve the issue. I've played with spaces before/after
comas, etc; no impact.

Can you spot anything in the rule that I might have overlooked or just kept
reading right through it?

Rich




-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
> From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users