Snort - the de facto standard for intrusion detection/prevention
Search Site
Search Rules
Account
email
password
not registered?
can't login?
user preferences
Next:
3.1 The Basics
Up:
Snort
TM
Users Manual 2.4.0RC1
Previous:
2.3 Output Modules
Contents
3
. Writing Snort Rules
How to Write Snort Rules and Keep Your Sanity
Subsections
3
.
1
The Basics
3
.
2
Rules Headers
3
.
2
.
1
Rule Actions
3
.
2
.
2
Protocols
3
.
2
.
3
IP Addresses
3
.
2
.
4
Port Numbers
3
.
2
.
5
The Direction Operator
3
.
2
.
6
Activate/Dynamic Rules
3
.
3
Rule Options
3
.
4
Meta-Data Rule Options
3
.
4
.
1
msg
3
.
4
.
2
reference
3
.
4
.
3
sid
3
.
4
.
4
rev
3
.
4
.
5
classtype
3
.
4
.
6
Priority
3
.
5
Payload Detection Rule Options
3
.
5
.
1
content
3
.
5
.
2
nocase
3
.
5
.
3
rawbytes
3
.
5
.
4
depth
3
.
5
.
5
offset
3
.
5
.
6
distance
3
.
5
.
7
within
3
.
5
.
8
uricontent
3
.
5
.
9
isdataat
3
.
5
.
10
pcre
3
.
5
.
11
byte_test
3
.
5
.
12
byte_jump
3
.
5
.
13
ftpbounce
3
.
5
.
14
regex
3
.
5
.
15
content-list
3
.
6
Non-payload Detection Rule Options
3
.
6
.
1
fragoffset
3
.
6
.
2
ttl
3
.
6
.
3
tos
3
.
6
.
4
id
3
.
6
.
5
ipopts
3
.
6
.
6
fragbits
3
.
6
.
7
dsize
3
.
6
.
8
flags
3
.
6
.
9
flow
3
.
6
.
10
flowbits
3
.
6
.
11
seq
3
.
6
.
12
ack
3
.
6
.
13
window
3
.
6
.
14
itype
3
.
6
.
15
icode
3
.
6
.
16
icmp_id
3
.
6
.
17
icmp_seq
3
.
6
.
18
rpc
3
.
6
.
19
ip_proto
3
.
6
.
20
sameip
3
.
7
Post-Detection Rule Options
3
.
7
.
1
logto
3
.
7
.
2
session
3
.
7
.
3
resp
3
.
7
.
4
react
3
.
7
.
5
tag
3
.
8
Event Thresholding
3
.
8
.
1
Standalone Options
3
.
8
.
2
Standalone Format
3
.
8
.
3
Rule Keyword Format
3
.
8
.
4
Rule Keyword Format
3
.
8
.
5
Examples
3
.
9
Event Suppression
3
.
9
.
1
Format
3
.
9
.
2
Examples
3
.
10
Snort Multi-Event Logging (Event Queue)
3
.
10
.
1
Event Queue Configuration Options
3
.
10
.
2
Event Queue Configuration Examples
3
.
11
Writing Good Rules
3
.
11
.
1
Content Matching
3
.
11
.
2
Catch the Vulnerability, Not the Exploit
3
.
11
.
3
Catch the Oddities of the Protocol in the Rule
3
.
11
.
4
Optimizing Rules
3
.
11
.
5
testing numerical values
site feedback
|
Terms of Use
|
Privacy Policy
|
forum archives
©2008 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved.