About a DDOS custom signature

["Kensuke Morita (kenmorit)" <kenmorit () cisco com>]

Hi

Does anyone know how to create a simple Anti-DDOS signature?
If followings were possible, it would be very helpful.
-----------
1. Setup maximum session
2. Setup a protected IP address (It will be a server address that a customer would like to protect.)
3. Setup which port is monitored.  (If setup port 80, then only check the session of HTTP traffic.)
3. Setup an idle time of half open.
4. Setup an idle time of session.
5. Setup an idle time of half close.
-----------

Best Regards,

------------------------------------------------------------------------------

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!