Re: download size limit

[Matt Kettler <mkettler () evi-inc com>]

At 01:11 PM 1/18/2005, Gentian Hila wrote:
> I was wondering if snort can detected when a user (internally) uses
> more than a certain bandwidth for downloading (i.e. 2 Mb) Is there an
> automatic rule to do that ?
> Or do I need to write my own rule to do that ? Is it possible at all ?
>
> I am very new at Snort so please forgive if that's not something snort
> does at all

That's not something snort does at all. Snort's designed to look for 
particular contents in network packets, or tcp streams, but it's usual 
"window of inspection" is no more than 64kb.

You might be able to hack something up with thresholding with a rule that 
triggers on any packet over 1000 bytes, but it would be kludgy and 
inaccurate at best...

If you want to do bandwidth limiting, you might want to look at QoS 
features in various routers and/or firewalls (including opensource tools 
like IPTables) 



-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users