Snort mailing list archives
tracking failing TCP connection attempts with snort
From: "Jim Hendrick" <jrhendri () maine rr com>
Date: Tue, 16 Nov 2004 21:03:01 -0500
Hi, I am looking for a way to alert (or log) on failing incoming TCP connections. For example, if an inbound connection attempts to connect to a server, and the server never responds, I'd like something that can alert. I have been looking at using tagged connections, but I'm not sure how to setup the "alert if a connection is *not* established" logic. I know something like this will tag inbound connections from "host" for 30 seconds: alert tcp any any -> $HTTP_SERVERS 80 (flags: S; \ tag: host, 30, seconds; msg: "incoming http session";) But how can I continue and say: alert {"magic syntax here": tcp $HTTP_SERVERS 80 -> host \ (30 seconds and no SYN/ACK); msg: "failed HTTP connection attempt";) ????? Thanks for any tips! Jim Hendrick ------------------------------------------------------- This SF.Net email is sponsored by: InterSystems CACHE FREE OODBMS DOWNLOAD - A multidimensional database that combines robust object and relational technologies, making it a perfect match for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- tracking failing TCP connection attempts with snort Jim Hendrick (Nov 16)
- Re: tracking failing TCP connection attempts with snort stephane nasdrovisky (Nov 16)
- RE: tracking failing TCP connection attempts with snort Jim Hendrick (Nov 17)
- Re: tracking failing TCP connection attempts with snort stephane nasdrovisky (Nov 16)