Using snort as connection tracker

["Klemen Mihevc" <mafia-x () volja net>]

Hello,

 

I'm kinda new in >advanced< snort configuration. Until now i only used it
with >default< cfg & rules. Now i have a problem, I'm runing on linux server
2 gameservers on udp port 27960 & 28960 i made 2 custom rules to track that
connections:

 

alert udp $EXTERNAL_NET any -> $HOME_NET 27960 (msg:"Enemy Territory
player";)

 

alert udp $EXTERNAL_NET any -> $HOME_NET 28960 (msg:"Call of Duty player";)

 

 

now i have a problem couse every packet is logged (and logs are huge) even
if it's only about 1k big and it is product of outside scan of server not
actual connection to it. Is there anyway to log only first and last package
from 1 ip and only if data transfer is bigger then let's say 5k? Or maybe
anyother way to log that connections? I also tryed with chaosreader &
tcpdump but this method is too much cpu & ram consuming and i also tried
with iptable but again with same problem (every package is logged). I relay
wanna use snort because i can use mysql & acid for statistic...

 

 

Thx

 

 

PS: sorry for my bad english ;)