SYN flood detection

[Pawel Rogocz <pawel () rogocz com>]

I was really surprised to find out snort does not detect syn floods.
Checking spp_portscan.c it looks like a small change should take care
of the problem. I am attaching a diff against 1.8.6.
It works for me, YMMV :-)


Pawel


*** spp_portscan.old    Fri May 10 03:27:39 2002
--- spp_portscan.c      Fri May 10 03:39:03 2002
***************
*** 666,672 ****
                          if(currentConnection == NULL)
                              FatalError(MODNAME ": currentConnection is NULL!!!??\n");
  
!                         if((currentConnection->dport == dport) && (currentConnection->scanType == scanType))
                          {
                              /*
                               * If the same exact connection already exists,
--- 666,672 ----
                          if(currentConnection == NULL)
                              FatalError(MODNAME ": currentConnection is NULL!!!??\n");
  
!                         if((currentConnection->sport == sport) && (currentConnection->dport == dport) && 
(currentConnection->scanType == scanType))
                          {
                              /*
                               * If the same exact connection already exists,


-- 

_______________________________________________________________

Have big pipes? SourceForge.net is looking for download mirrors. We supply
the hardware. You get the recognition. Email Us: bandwidth () sourceforge net
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users