RE: Help with Rules

["Basselgia, Barry A Mr (NAF Atsugi)" <BABasselgia () atsugi navy mil>]

Have you checked out the bleeding edge rules at www.bleedingsnort.com, they
have a very good collection of virus, spyware, adware rules.  

Barry


-----Original Message-----
From: snort-users-admin () lists sourceforge net
[mailto:snort-users-admin () lists sourceforge net]On Behalf Of Kevin Smith
Sent: Friday, April 01, 2005 3:13 AM
To: Briggs, Bruce; snort-users () lists sourceforge net
Subject: [Snort-users] Help with Rules


Hey Bruce,

Here is the rule I have been messing around with.
alert tcp $NETWORK any -> any any (tag:session,600,seconds;)

I have also tried
alert tcp $NETWORK any -> any any (tag:host,100,packets,src;)

Where network is defined as:
var NETWORK [64.7.160.0/19]

Mainly, the rules are logging the correct information. The problem is I
am just receiveing way to much information to handle. I have a php
script that is going through the information and sending e-mails to our
support staff to let them know of any possible problems (such as
spy-ware, viruses, etc) to the end user. he problem is that the database
will get up to 100,000 records and when the script runs and removes the
old information for a customer who isn't online any more it will take
forever to remove the information and the system's resources just max
out. If the information is low, in the thousands, it runs fine. So I
would like to get a handle of the packets and log them, versus everyone
that comes across the interface. I thought tag would do that, but I am
guessing it is not.

Any ideas?

Thanks,
Kevin



-------------------------------------------------------
This SF.net email is sponsored by Demarc:
A global provider of Threat Management Solutions.
Download our HomeAdmin security software for free today!
http://www.demarc.com/info/Sentarus/hamr30
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
This SF.net email is sponsored by Demarc:
A global provider of Threat Management Solutions.
Download our HomeAdmin security software for free today!
http://www.demarc.com/info/Sentarus/hamr30
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users