tracking failing TCP connection attempts with snort

["Jim Hendrick" <jrhendri () maine rr com>]

Hi,

  I am looking for a way to alert (or log) on failing incoming TCP
connections.

For example, if an inbound connection attempts to connect to a server, and
the server never responds, I'd like something that can alert. 

I have been looking at using tagged connections, but I'm not sure how to
setup the "alert if a connection is *not* established" logic.

I know something like this will tag inbound connections from "host" for 30
seconds:

alert tcp any any -> $HTTP_SERVERS 80 (flags: S; \
  tag: host, 30, seconds; msg: "incoming http session";)

But how can I continue and say:

alert {"magic syntax here": tcp $HTTP_SERVERS 80 -> host \
  (30 seconds and no SYN/ACK); msg: "failed HTTP connection attempt";)

?????

Thanks for any tips!

Jim Hendrick




-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users