Re: http-tunnel rule

[Thomas Werth <thomas.werth () vahle de>]

As i read some documentation i read session shouldn't be used cause it
is intensivly and drops performance.
Although dsize seems to work always on current package not on size on
whole conversation. Is there an other approach to get size for whole
connection ?

The suggestet patch for adding age of connection , is it working like
session or less intensive ?

Maybe someone can describe how they catch http-tunnels :)


Victor Julien schrieb:
> Thomas Werth wrote:
> > hello,
> >
> > i'd like to add a rule to catch http tunnels.
> > Basicly i'd like to alert packets which are running through proxy having
> >  bigger size from client to server and are more than 2 minutes alive.
> >
> > As far i have something like this :
> >
> > alert tcp any any -> proxy 8080 (msg:"possible httptunnel"; dsize: >1000; )
> >
> > How do i add a time option to check for xx minutes ?
> >
> > Although actual i don't know exactly where to add this rule. As i am
> > using oinkmaster i guess this should be mentioned :)
> >
> > any suggestions are very welcomed.
>
> Maybe you can check out the patch, posted to snort-devel by Kees Cook 
> last week, for matching on session age. See: 
> http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/3306
>
> It should enable you to do something like:
>
> alert tcp any any -> proxy 8080 (msg:"possible httptunnel"; dsize: 
>  >1000; age:>120)
>
> Hope this helps,
> Victor
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share your
> opinions on IT & business topics through brief surveys -- and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 


-------------------------------------------------------------------
Dipl. Informatiker
Thomas Werth
Abteilung TDV

Tel.  : 02307 / 704-366
Fax   : 02307 / 704-444
E-Mail: thomas.werth () vahle de

Paul Vahle GmbH & Co. KG              URL    : http://www.vahle.de
Westicker Strasse 52  D-59174 Kamen   E-Mail : info () vahle de
-------------------------------------------------------------------



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users