snort-users November 2009 archive
Main Archive Page > Month Archives  > snort-users archives
snort-users: Re: [Snort-users] simple rule to alert when visitin

Re: [Snort-users] simple rule to alert when visiting a website

From: JJ Cummings <cummingsj_at_nospam>
Date: Tue Nov 17 2009 - 16:45:55 GMT
To: Rob Dixon <rob.l.dixon@gmail.com>


A few quick notes:

It's generally not a good idea to match against any ports and any source when you can avoid.. i.e. alert tcp any -> $ebay_servers any.. also, you will likely be better off using uricontent rather than contrent when looking for this

alert tcp $HOME_NET any -> $EBAY_SERVERS $HTTP_PORTS (msg"EBAY FOO!!"; flow:established,to_server; uricontent:"match this trash";nocase.......................

The above is how I would approach it, depending on what specifically you are looking for of course... please read the docs and learn about:

  • port variables
  • general snort variables
  • flow
  • uricontent
  • content

As a side note, once you create your rule(s), you can run them through dumbpig to see if you made any mistakes or can improve them.

http://leonward.wordpress.com/2009/06/07/dumbpig-automated-checking-for-snort-rulesets/

Regards,
JJC
On Tue, Nov 17, 2009 at 9:25 AM, Rob Dixon <rob.l.dixon@gmail.com> wrote:

> Hi Mary,
>
> There are some setup guides and other documentation @snort.org that cover
> this subject.
>
> There are a few ways to do this.
>
> You could simply use a content match to look for "ebay.com", but this
> would also trigger for any site that has that text.(false positives)
>
> You could set a variable in the snort.conf and call it $ebay_servers and
> put ebays net block in there? Then write a simple rules to match the headers
> only. (more efficient)
>
> Alert tcp any any -> ebay_servers any (msg:"Warning - EBAY Activity";)
> something like that?
>
> Or, use squid in passive mode.
>
> Sounds like fun, good luck!
>
> Rob
>
> On Tue, Nov 17, 2009 at 10:49 AM, mary andrews <maryandrews22@gmail.com>wrote:
>
>> Forgive us, but we are evaluating the software and we are now learning it
>> too,
>> OK, I suppose you can call us newbies.
>>
>>
>> we are trying to write simple rules, we have had some success so far,
>> a little at a time, we are now trying to write a small rule to alert if
>> someone
>> is visiting a specific site, say www.ebay.com
>>
>> so far we have this in a file called testing.rules.
>>
>> # testing.rules
>> alert icmp any any -> any any (msg:"$$$$$TESTING rule$$$$$"; sid:1000001;)
>>
>> its rudimentary, we know, but its working ok. before we uncomment the
>> config and include
>> a bigger set of rules, we want to regresstion test them in their simplest
>> form.
>>
>> if someone replies, and since I am not 100% sure how this list works yet,
>> could you please copy me here? maryandrews22@gmail.com
>>
>> many thanks,
>> m
>>
>>
>> ------------------------------------------------------------------------------
>> Let Crystal Reports handle the reporting - Free Crystal Reports 2008
>> 30-Day
>> trial. Simplify your report design, integration and deployment - and focus
>> on
>> what you do best, core application coding. Discover what's new with
>> Crystal Reports now. http://p.sf.net/sfu/bobj-july
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users@lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users<https://lists.sourceforge.net/lists/listinfo/snort-users%0ASnort-users>list archive:
>> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>>
>
>
>
> --
> Hackers for Charity Board Member
> GPEN, C|HFI, ESSE-D, SnortCP, TNAP, TNCP, TECP, A+, whatever..
>
> Bad news doesn't get any better with age.
>
>
> ------------------------------------------------------------------------------
> Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
> trial. Simplify your report design, integration and deployment - and focus
> on
> what you do best, core application coding. Discover what's new with
> Crystal Reports now. http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
--

------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july

_______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users