Re: Alert on Max connections per IP

["Al Lewis (allewi)" <allewi () cisco com>]

Section on thresholding:

See the section on the detection filters.

http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node34.html#detection_filter


1)  track by the source - source IP match
2)  count  - number of rule matching in seconds that will cause event_filter limit to be exceeded. 
3 ) within 60 seconds - within the time specified


The third packet that matches the source IP will trigger an alert if within the 60 second time period.



Albert Lewis
QA SNORT/Sourcefire
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046 
Phone: (office) 443.430.7112
Email: allewi () cisco com 

-----Original Message-----
From: Argcyborg [mailto:argcyborg () gmail com] 
Sent: Monday, June 06, 2016 6:40 PM
To: wkitty42 () windstream net; snort-users () lists sourceforge net
Subject: Re: [Snort-users] Alert on Max connections per IP

Hi, if I use this rule, what be the threshold two config?
alert tcp $EXTERNAL_NET any -> 192.168.1.50 4000 ( msg:"Deteccion de conexiones"; flow:established,to_server; 
content:"|0d 00 00 00 50 cc 5d ed
b6 19 a5 91 00|"; nocase; rawbytes; detection_filter: track by_src, count 2, seconds 60; sid:1000050; rev:1;)

Thanks again!

-----Mensaje original-----
De: wkitty42 () windstream net [mailto:wkitty42 () windstream net] Enviado el: domingo, 5 de junio de 2016 20:41
Para: snort-users () lists sourceforge net
Asunto: Re: [Snort-users] Alert on Max connections per IP

On 06/05/2016 05:39 PM, Argcyborg wrote:
> Hi, is there a way to alert or drop when receive more than 8 
> connections
per ip
> to an specific port ?

that's called thresholding...

--
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

----------------------------------------------------------------------------
--
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals 
which users, apps, and protocols are

consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, sFlow and other flows. Make informed 
decisions using capacity planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals 
which users, apps, and protocols are consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, 
sFlow and other flows. Make informed decisions using capacity planning reports. 
https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity 
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!