[Snort-users] Activates/Dynamic

Are Activate/Dynamic rules still supported in the more recent releases of Snort?

I have an interesting problem i am trying to solve, that I'd love to
use Activate/Dynamic for. However the documentation is telling me
that the use of those options is being phased out in favor of tagging.

I don't think i can do what i want to do with tagging, so I'd like to
know if I can still use Activate/Dynamic in 2.2.0rc1.

For the curious ones, here is what i am trying to achieve:

Occasionally, during some really wierd hours, the CPU utilization on
one of my routers spikes to 70% or higher. I know it's because of a
sudden spike in network traffic, but i don't know what the traffic is.
I send snmp queries to the router which responds with the cpu
utilization. I am using byte_test to check the value of the cpu
utilization and I'd like to activate the dynamic portion if the
utilization is above 40%. The dynamic rule would capture a million or
so packets.

I have a rule that if set to "alert" or even "activate", gets
triggered upon seeing the correct packet. However the "dynamic" part
never does anything, so I am nowhere.

activate udp router 161 -> host any (msg:"Utilization above 12%";
activates:1; content:"|04 01 09 02 01 39 00 02 01|"; offset:36;
depth:9; byte_test:1,>,0x0B,0,relative;)

dynamic tcp any any -> any any (activated_by: 1; msg:"Activated"; count: 50;)

I don't think i can do this with tagging because i am trying to
capture ALL traffic, not just between the two hosts that generated the
original event.

Any ideas?


-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users