Snort Forums Archive

Archive Home » Rules » Keyword search rule.

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Keyword search rule.

Posted by eccentric67 on March 23, 2005 09:51:48

I would like to create a simple keyword rule. If for example, someone's social security number was being copied from a trusted machine and going to some external host. Could someone assit me in how to key into words? I guess this would be like content filtering with Snort.

Thanks

Posted by iceburn on March 24, 2005 00:30:24

You should read the snort manual. It's not that long. Or at least the rules related part.
I'm guessing you are trying to scan a textual string within the traffic. This is acomplished by using the content directive. You can also write content detection rules with regular expressions (read documentation). Warning, if the traffic you are trying to intercept is ciphered you woun't get any results.
Try looking at the porn.rules file. It's the simplest set of rules. Note that all this rules are intended for http traffic. If you are also looking for that information in this servers/ports you should also use this specifications in the rules for speed purposes.