Catchall Rule

["John Cherbini" <cherbini () dakotacom net>]

Hello everyone...

We're working on a project, where as a part of it, we would like to use
snort to add *every* packet it reads in a file to the DB.

I've got the command line down, but I'd like to check on a rule that
will set *every* packet to generate a flag.

After looking through this doc..

http://www.snort.org/docs/writing_rules/chap2.html

I'm thinking something like this:

Alert tcp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
Alert udp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)
Alert icmp any any -> any (content:"|45 00|"; msg: "Catchall Rule";)

My concern is the third "any"...not sure if that will work.

Does anyone have any input on this?

I'd appreciate any advice!

Thanks!

John Cherbini