Re: http-tunnel rule

[Victor Julien <victor () nk nl>]

Thomas Werth wrote:
> hello,
>
> i'd like to add a rule to catch http tunnels.
> Basicly i'd like to alert packets which are running through proxy having
>  bigger size from client to server and are more than 2 minutes alive.
>
> As far i have something like this :
>
> alert tcp any any -> proxy 8080 (msg:"possible httptunnel"; dsize: >1000; )
>
> How do i add a time option to check for xx minutes ?
>
> Although actual i don't know exactly where to add this rule. As i am
> using oinkmaster i guess this should be mentioned :)
>
> any suggestions are very welcomed.

Maybe you can check out the patch, posted to snort-devel by Kees Cook 
last week, for matching on session age. See: 
http://permalink.gmane.org/gmane.comp.security.ids.snort.devel/3306

It should enable you to do something like:

alert tcp any any -> proxy 8080 (msg:"possible httptunnel"; dsize: 
> 1000; age:>120)

Hope this helps,
Victor

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users