Re: Alert on Max connections per IP

["Argcyborg" <argcyborg () gmail com>]

Thanks for the answers, what I need is to detect more than 2 connections to
the port 4000 in less than 60 seconds and get the IP address of the
"attacker".
What should I write in the rules file?

Thanks in advance!





-----Mensaje original-----
De: wkitty42 () windstream net [mailto:wkitty42 () windstream net] 
Enviado el: martes, 7 de junio de 2016 12:22
Para: snort-users () lists sourceforge net
Asunto: Re: [Snort-users] Alert on Max connections per IP

On 06/06/2016 06:40 PM, Argcyborg wrote:
> Hi, if I use this rule, what be the threshold two config?
> alert tcp $EXTERNAL_NET any -> 192.168.1.50 4000 ( msg:"Deteccion de 
> conexiones"; flow:established,to_server; content:"|0d 00 00 00 50 cc 
> 5d ed
> b6 19 a5 91 00|"; nocase; rawbytes; detection_filter: track by_src, 
> count 2, seconds 60; sid:1000050; rev:1;)

this rule fires if there are two connections from the same IP to the
destination IP within sixty seconds... the detection_filter portion is the
old in-rule thresholding... it was changed because there's also the
threshold.conf file which can do similar... you cannot threshold.conf a rule
with detection_filter in it... it is viewed as thresholding a thresholded
rule and for some reason that's not allowed...

if you want the rule above to fire less often, then try increasing the count
and seconds values...

> Thanks again!
>
> -----Mensaje original-----
> De: wkitty42 () windstream net [mailto:wkitty42 () windstream net] Enviado 
> el: domingo, 5 de junio de 2016 20:41
> Para: snort-users () lists sourceforge net
> Asunto: Re: [Snort-users] Alert on Max connections per IP
>
> On 06/05/2016 05:39 PM, Argcyborg wrote:
> > Hi, is there a way to alert or drop when receive more than 8 
> > connections
> per ip
> > to an specific port ?
>
> that's called thresholding...


--
  NOTE: No off-list assistance is given without prior approval.
        *Please keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

----------------------------------------------------------------------------
--
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort
news!


------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity 
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!