Re: General suspicious traffic detection

[Erek Adams <erek () theadamsfamily net>]

On Wed, 4 Sep 2002, James Bly wrote:

> Has anyone given any thought to ways to define through snort, a list of
> authorized protocols on a particular interface, so that any other protocols
> appearing on the wire would trigger alerts? Essentially defining and
> "authorized port" policy.
>
> Granted some protocols would require protocol interpretation to avoid false
> positives (like FTP, Streaming Video, etc) but my consideration is for wires
> where all ports can be defined. (i.e. such and such wire should only see
> nntp, ssh, and telnet)
>
> Thoughts are greatly appreciated,

Ask and ye shall recieve.

> From the CVS Changelog:

2002-08-13  Chris Green  <cmg () sourcefire com>

        * src/preprocessors/spp_conversation.c:
          new option alert_odd_protocols
          set allowed_ip_protocols to the numbers you like and it will alert
          on all bad protocols

:)

Added in to 1.9 CVS version.

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net



-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users