Re: Snort 1.9 flow keyword

[Brian <bmc () snort org>]

On Tue, Oct 29, 2002 at 09:26:43AM -0800, shadi Rostami wrote:
> Hello,
> What is the difference between 
> to_client and from_server and
> to_server and from_client
> values for flow keyword.

To add to chris's comments, the reason there are duplicate flow keywords
is to provide some context to the rules.

Example 1:

 alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any \
    (msg:"ATTACK RESPONSES http dir listing"; \
    content: "Volume Serial Number"; \
    flow:from_server,established; \
    classtype:bad-unknown; sid:1292; rev:4;)

In this rule, we look for "Volumne Serial Number" coming from our
web server.  In this rule, we are concerned about our web server,
so I use the "from_server" option.



Example 2:

 alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any \
    (msg:"WEB-CLIENT readme.eml autoload attempt"; \
    flow:to_client,established; \
    content:"window.open(\"readme.eml\""; nocase; \
    classtype:attempted-user; sid:1290; \
    reference:url,www.cert.org/advisories/CA-2001-26.html; \
    rev:8;)

In this rule, we look for "window.open(\"readme.eml\"" going towards
our client.  In this rule, we are concerned about our client, so I
use the "to_client" option.

-brian


-------------------------------------------------------
This sf.net email is sponsored by: See the NEW Palm 
Tungsten T handheld. Power & Color in a compact size!
http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0001en
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users