Re: tracking failing TCP connection attempts with snort

[stephane nasdrovisky <stephane.nasdrovisky () paradigmo com>]

Jim Hendrick wrote:

>  I am looking for a way to alert (or log) on failing incoming TCP
> connections.
>  
alert both on tcp rst packets and icmp host (& port) unreachable 
(TCP-IP  Illustrated by W.Richard Stevens is great if you don't want to 
read ip, tcp & icmp related rfcs).

> For example, if an inbound connection attempts to connect to a server, and
> the server never responds, I'd like something that can alert.
>  
It should never happen, the server will answer with a RST (or icmp port 
or proto unreachable) packet or the previous hop (router) will generate 
an icmp host unreachable.

> I have been looking at using tagged connections, but I'm not sure how to
> setup the "alert if a connection is *not* established" logic.
>
> I know something like this will tag inbound connections from "host" for 30
> seconds:
>
> alert tcp any any -> $HTTP_SERVERS 80 (flags: S; \
>  tag: host, 30, seconds; msg: "incoming http session";)
>
> But how can I continue and say:
>
> alert {"magic syntax here": tcp $HTTP_SERVERS 80 -> host \
>  (30 seconds and no SYN/ACK); msg: "failed HTTP connection attempt";)
>  
Could be something like:

alert tcp $HTTP_SERVERS 80 -> any any (flags: R; \
 ; msg: "outgoing http rst - http server down";)
But usually HTTP_SERVERS do not reply to port 80 with a RST packet, they answer the query.






-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users