Re: session monitoring question

["John Pritchard" <john.r.pritchard () gmail com>]

Eddie,

This might not be exactly what you are after, but try the following...

log ip any any -> <target> any (msg:"Traffic to Monitored DST
Address"; flow:established; sid:1000001; rev:1;)

And, if you wanted information of activity from your Monitored
address, try something like:

log ip any <target> -> any any (msg:"Traffic from Monitored SRC
Address"; flow:established; sid:1000002; rev:1;)

Lastly, you could do things like create specific signatures for "log
tcp", "log udp", or "log icmp" if you didn't want everything that the
"log ip" will give you....

Cheers, John

On 8/2/07, Eddie Corns <E.Corns () ed ac uk> wrote:
> Hi all,
> I've started looking at Snort.  The first thing I decided to try and do was
> using it to monitor traffic inbound to particular host(s).  That is I want to
> log all traffic on sessions that were initiated by an external host and
> completely ignore all traffic for sessions initiated by the monitored
> host(s).  However I think I need some help to get started.
>
> So far I've created a config file where I've commented out everything except
> flow, frag3 and stream5 and added an include to my.rules.  ie
> var HOME_NET 129.215.200.0/24
> var EXTERNAL_NET any
> var DNS_SERVERS $HOME_NET
> var SMTP_SERVERS $HOME_NET
> var HTTP_SERVERS $HOME_NET
> var SQL_SERVERS $HOME_NET
> var TELNET_SERVERS $HOME_NET
> var SNMP_SERVERS $HOME_NET
> var HTTP_PORTS 80
> var SHELLCODE_PORTS !80
> var ORACLE_PORTS 1521
> var AIM_SERVERS 
> [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]
> var RULE_PATH /home/eddie/snort/rules
> dynamicpreprocessor directory /usr/local/lib/snort/dynamicpreprocessor/
> dynamicengine /usr/local/lib/snort/dynamicengine/libsf_engine.so
> preprocessor flow: stats_interval 0 hash 2
> preprocessor frag3_global: max_frags 65536
> preprocessor frag3_engine: policy first detect_anomalies
> preprocessor stream5_global: max_tcp 8192, track_tcp yes, \
>                              track_udp no
> preprocessor stream5_tcp: policy first, use_static_footprint_sizes, \
>    ports client all, timeout 86400
> include $RULE_PATH/my.rules
>
> In my.rules I've experimented a little but I'm not sure what to do.  My first
> attempt was:
>
>   log IP any any -> <target> any (flow:from_client,only_stream;sid:9999;)
>
> this didn't do anything at all.  Removing only_stream showed that it was at
> least doing something but not presumably what I want.
>
> Am I even going in the right direction?  I had hoped the stream_only option
> was a simple way of waiting until the end (though I realise this may not be
> the best idea in the long run).  Do I need some multistage set of rules with
> flowbits or some such?  Any hints appreciated.
>
> Cheers,
> Eddie
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >>  http://get.splunk.com/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users