Re: simple rule to alert when visiting a website

[Joel Esler <jesler () sourcefire com>]

There are plenty of docs to learn how to do this on snort.org, as well
as being included with the Snort software that you downloaded.

I don't know how you intend to perform "regression" testing on the
rules. But let us know how that works out.

Alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"test eBay
rule"; flow:to_server,established; content:"eBay.com"; nocase;
sid:1000000; rev:1;)

is a more proper way to do what you want.

Ip rules = generally bad
any any rules = generally bad

there are all kinds of webinars, white papers, and instructions to
help you do what you want on Snort.org. I would encourage you to check
those out as the rule I wrote above will fit only a very specific
service and function.

J
-written on a cell phone



On Tuesday, November 17, 2009, mary andrews <maryandrews22 () gmail com> wrote:
> well, I am using ebay.com as an example, but basically yes.
>
> On Tue, Nov 17, 2009 at 11:03 AM, Joel Esler <jesler () sourcefire com <javascript:_e({}, 'cvml', 'jesler () 
> sourcefire com');>> wrote:
> So, your question is, how to write a rule to detect someone going to eBay?
>
> J
>
> On Tuesday, November 17, 2009, mary andrews <maryandrews22 () gmail com <javascript:_e({}, 'cvml', 'maryandrews22 () 
> gmail com');>> wrote:
> > Forgive us, but we are evaluating the software and we are now learning it too,
> > OK, I suppose you can call us newbies.
> >
> >
> > we are trying to write simple rules, we have had some success so far,
> > a little at a time, we are now trying to write a small rule to alert if someone
> > is visiting a specific site, say www.ebay.com <http://www.ebay.com/> <http://www.ebay.com/>
> >
> > so far we have this in a file called testing.rules.
> >
> > # testing.rules
> > alert icmp any any -> any any (msg:"$$$$$TESTING rule$$$$$"; sid:1000001;)
> >
> >
> > its rudimentary, we know, but its working ok. before we uncomment the config and include
> > a bigger set of rules, we want to regresstion test them in their simplest form.
> >
> > if someone replies, and since I am not 100% sure how this list works yet,
> > could you please copy me here? maryandrews22 () gmail com <javascript:_e({}, 'cvml', 'maryandrews22 () gmail com');> 
> > <javascript:_e({}, 'cvml', 'maryandrews22 () gmail com <javascript:_e({}, 'cvml', 'maryandrews22 () gmail com');>');>
> >
> > many thanks,
> > m
>
> --
> Joel Esler | 302-223-5974 | gtalk: jesler () sourcefire com <javascript:_e({}, 'cvml', 'jesler () sourcefire com');>

-- 
Joel Esler | 302-223-5974 | gtalk: jesler () sourcefire com

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users