Re: Any examples of logging via dynamic rules out there?

[Jason Haar <Jason.Haar () trimble co nz>]

I've come up with a variation that partially works, can someone tell me what
I'm missing?

ruletype suspicious
{
    type alert
    output log_tcpdump: suspicious.log
}
     
suspicious tcp 1.2.34 any -> 2.3.4.5 25 \
(msg:"Tagtester";flags: A+;tag:session,10,seconds;)

> From what I can understand, that should activate suspicious.log when such a
SMTP connection is made. The fact that I chose "session" over "host" in the
tag field should mean I get bi-directional - right?

Well, what happened is that a 0823 () 2035-suspicious log was created after
restarting snort. Upon having a SMTP session and exiting, the file was still
0 bytes! I HUP'ed snort, and then the data was flushed. Upon running
ethereal on it, I saw that I was only seeing the packets from 1.2.3.4 *to*
2.3.4.5 - the return packets are missing.

I can run tcpdump and see both directions - so this is a snort issue - not a
networking one.

Now, that sounds more like the way "tag: host" is meant to work doesn't it?
I've tried several pertubations of flags - to no avail.

Bug or misunderstanding?


snort-1.8-1-RELEASE under RH-6.2.

On Sat, Aug 18, 2001 at 10:45:24AM -0400, Martin Roesch wrote:
> Use tagging:
>
> alert tcp !$HOME_NET any -> $!HOME_NET 143 (flags: S; tag: session, 60,
> seconds; msg: "Tracking inbound IMAP session";)
>
> That'll do it.
>
>      -Marty
>
> Jason Haar wrote:
> > I've tried setting up a dynamic rule so that I could catch (say), a whole
> > IMAP session. I want it saved in tcpdump format, but can't get it to work.
> >
> > Any ideas?
> >
> > ruletype catchimap
> > {
> >  type dynamic
> >  output log_tcpdump: imapsessions.log
> > }
> >
> > activate tcp !$HOME_NET any -> $HOME_NET 143 (flags: PA; activates: 1;)
> > catchimap tcp !$HOME_NET any -> $HOME_NET 143 (activated_by: 1;)
> >
> > --
> > Cheers
> >
> > Jason Haar
> >
> > Unix/Special Projects, Trimble NZ
> > Phone: +64 3 9635 377 Fax: +64 3 9635 417
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> --
> Martin Roesch
> roesch () sourcefire com
> http://www.sourcefire.com - http://www.snort.org

-- 
Cheers

Jason Haar

Unix/Special Projects, Trimble NZ
Phone: +64 3 9635 377 Fax: +64 3 9635 417

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users