|
|
|
|
Snort Forums Archive
Archive Home » Rules » Number of Conections rules
Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.
[ Notice: Full Version of This Topic ]
Number of Conections rules
Posted by pastor on April 14, 2005 13:42:36
I need to know if a host pass certain rate of conections to a destination on my network, ie. I need to know if 200.155.0.10 had 10 conection to 192.168.0.1 on 1 sec. It is posible with a rule? Anyone knows if there is some rule that can do that?
Let me know please.
cheers ;) |
|
Posted by bfranklin on April 19, 2005 05:53:16
By connections, I assume you mean TCP.
alert tcp srcip any -> dstip any (threshold: type both, track by_src, count 10, seconds 1;)
Take another read through the thresholding section of the snort manual. |
|
|
|
|
|
