Snort mailing list archives
Help with writting a rule
From: Kevin Smith <kjsmith () tm net>
Date: Wed, 30 Mar 2005 22:37:50 -0500
To anyone who can help,I am a bit confused on writing rules. I am trying to write, at least what I think a pretty simple rule. Basically we have all the traffic filtered out, meaning any traffic that is not going to an IP address will be sent to the snort box. With this we are going to determine if the user is having say spy-ware or virus related problems so we can notify them. I am running into trouble getting my rules to work, or they work so well, it just fills the database up to an unmanageable level.
Now, my question is that right now it is logging what appears to be any packet sent by the user. I would like to get a handful of that information, for example, have 1 log for every 100 packets. Is this possible? If so, what options do I need to use?
Thanks, Kevin ------------------------------------------------------- This SF.net email is sponsored by Demarc: A global provider of Threat Management Solutions. Download our HomeAdmin security software for free today! http://www.demarc.com/info/Sentarus/hamr30 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Help with writting a rule Kevin Smith (Mar 30)