Snort mailing list archives
RE: Help with Snort rule - httpd flood detection
From: "Basselgia, Barry A Mr (NAF Atsugi)" <BABasselgia () atsugi navy mil>
Date: Tue, 1 Mar 2005 10:35:38 +0900
I'd suggest checking out www.bleedingsnort.com. You may find that they already have a rule to do what you want and they are usually happy to help people develop new rules. Barry -----Original Message----- From: snort-users-admin () lists sourceforge net [mailto:snort-users-admin () lists sourceforge net]On Behalf Of Scott / NightStorm Sent: Tuesday, March 01, 2005 5:46 AM To: snort-users () lists sourceforge net Subject: Re: [Snort-users] Help with Snort rule - httpd flood detection If I knew where to even start, I would do so... why I was hoping for some help from the list. So far, I've found nothing, so I'm lost on it. Thus far, the only content that is consistent throughout the various attacks are the fact that all the various bots all hit the exact same spot all at once.. nothing else is consistent from one attack to the next (other than the sender). ----- Original Message ----- From: "Jeremy Hewlett" <jh () sourcefire com> To: <snort-users () lists sourceforge net> Sent: Monday, February 28, 2005 1:44 PM Subject: Re: [Snort-users] Help with Snort rule - httpd flood detection
On Sat, Feb 26, NightStorm wrote:What I am hoping to do is somehow get Snort to recognise massive queries to a specified page, and then trigger a rule. Unfortunately,Have you tried creating your own rule, looking for whatever content, and putting a threshold of type "Both" on it?
------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Help with Snort rule - httpd flood detection NightStorm (Feb 26)
- Re: Help with Snort rule - httpd flood detection Jeremy Hewlett (Feb 28)
- Re: Help with Snort rule - httpd flood detection Scott / NightStorm (Feb 28)
- <Possible follow-ups>
- RE: Help with Snort rule - httpd flood detection Basselgia, Barry A Mr (NAF Atsugi) (Feb 28)
- Re: Help with Snort rule - httpd flood detection Jeremy Hewlett (Feb 28)