RE: Catchall Rule

["John Cherbini" <cherbini () dakotacom net>]

Never used bpf before....not sure what it does.....

Basically, we're working from the MIT Lincoln Labs data set, with a
number of different NIDS...

So the main objective is to avoid having to write our own binary tcpdump
format parser.  I'm sure there's one out there, but by using a catchall
rule, snort is now doing it for us.

I've already got 617592 records in the iphdr table......this will be a
big one.

On a side note, has anyone installed the evaluation version of
RealSecure?

John C.


> -----Original Message-----
> From: Jacob Redding [mailto:dextor () WiredGeek com] 
> Sent: Wednesday, February 05, 2003 9:34 PM
> To: John Cherbini
> Subject: RE: [Snort-users] Catchall Rule
>
>
>   well hey if it works, then use it.. I was just thinking 
> that using tcpdump would be faster and you can still usd bpf 
> on the dump afterwards or you could dump the data into a db 
> of your choosing.
>
>   Just out of curiosity, what are you doing? and what parser 
> are you referring to?
>
> -Jacob
>
>
>
> On Wed, 5 Feb 2003, John Cherbini wrote:
>
> > We wanted to have them all logged into a DB, and most importantly, 
> > parsed!  And we didn't feel like writing our own parser.
> >
> > I've got it figured out though......with these rules
> >
> > ######CATCHALL RULES########
> > alert tcp any any -> any any (msg: \"tcp traffic\";)
> > alert udp any any -> any any (msg: \"udp traffic\";)
> > alert icmp any any -> any any (msg: \"icmp traffic\";) 
> > ############################
> >
> > John C.
> >
> > > -----Original Message-----
> > > From: Jacob Redding [mailto:dextor () WiredGeek com]
> > > Sent: Wednesday, February 05, 2003 9:18 PM
> > > To: John Cherbini
> > > Cc: 'Snort User Groups'
> > > Subject: Re: [Snort-users] Catchall Rule
> > >
> > >
> > >   Why not just use tcpdump??
> > >
> > > -Jacob
> > >
> > > On Wed, 5 Feb 2003, John Cherbini wrote:
> > >
> > > > Hello everyone...
> > > >
> > > > We're working on a project, where as a part of it, we 
> would like 
> > > > to use snort to add *every* packet it reads in a file to the DB.
> > > >
> > > > I've got the command line down, but I'd like to check on a
> > > rule that
> > > > will set *every* packet to generate a flag.
> > > >
> > > > After looking through this doc..
> > > >
> > > > http://www.snort.org/docs/writing_rules/chap2.html
> > > >
> > > > I'm thinking something like this:
> > > >
> > > > Alert tcp any any -> any (content:"|45 00|"; msg: "Catchall 
> > > > Rule";) Alert udp any any -> any (content:"|45 00|"; msg: 
> > > > "Catchall Rule";) Alert icmp any any -> any (content:"|45 00|"; 
> > > > msg: "Catchall Rule";)
> > > >
> > > > My concern is the third "any"...not sure if that will work.
> > > >
> > > > Does anyone have any input on this?
> > > >
> > > > I'd appreciate any advice!
> > > >
> > > > Thanks!
> > > >
> > > > John Cherbini



-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users