Re: [Snort-users] ru.le to detect lots of syn pkts?

--On Friday, June 04, 2004 11:36:54 AM -0600 Rich Adamson
<radamson@routers.com> wrote:

>> > Of course. That's what thresholding is for. For example:
>> >
>> > If you only want to catch SYN packets:
>> > alert tcp $HOME)NET any -> any any (msg: "High traffic host, SYN
>> > packets"; flags:S; threshold: type both, track by_src, count 4000,
>> > seconds 60; classtype:misc-activity; sid: 1000002; rev:1;)
>
> Getting and error "*** Invalid integer input: 4000" using the above.
> Running v2.10. Do I need to upgrade to handle this?
>
No, something else is wrong. Thresholding has been in snort since about
2.0.4 (IIRC). It may be a syntax problem. Make sure that you have a colon
after threshold and commas after each keyword, and a semi-colon at the end.

threshold: type both, track by_src, count 4000, seconds 60;

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/ir/security/


-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users