Snort Rules

[mosquitooth () gmx net]

Hi,

I'm quite a newbie on snort, so please excuse my basic questions:
The following describes the way I understand the behaviour and use of snort
rules in the inernal system. Please comment on this (and correct me :~)).

First of all, snort divides all rules in (at least) 4 parts, based on
protocol (TCP/UDP/ICMP/IP). Now, there's a RuleTreeNode (RTN) for every type
of - let's say TCP - rule 'below' the main protocol list (rules that have
identical src/dest ips AND identical min/max src ports are combined, so you
can check several rules in one time). 
This RTN contains rule information, esp. two linked lists for source and
destination IP addresses and min/max- src/dest port (along with some flags
and other stuff, necessary to check if the current packet belongs to this
rule group).
Additionally, a linked list with the rule-specific barebones exits
(OptTreeNode = OPT). Here you can find the rules metadata and some keywords
(statefule inspection).
And that's exactly the point where I'm hampered. AFAIK you should find here
e.g. the content to search for, in short: every rule-specific information
that cannot be used to create deeper groups. But there is none!

So, could anyone tell me first, whether the above statements are correct,
second if this also applies to the new rule engine in snort 2.x and third
how the system continues at the point where I'm stucked.

Now, I excuse for my bad english and whish you all 'Merry Christmas'

Peter

P.S.: Just to mention, why does snort fire several alerts per packet?
Shouldn't be one enough? 


-- 
+++ Sparen Sie mit GMX DSL +++ http://www.gmx.net/de/go/dsl
AKTION für Wechsler: DSL-Tarife ab 3,99 EUR/Monat + Startguthaben


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users