http-tunnel rule

[Thomas Werth <thomas.werth () vahle de>]

hello,

i'd like to add a rule to catch http tunnels.
Basicly i'd like to alert packets which are running through proxy having
 bigger size from client to server and are more than 2 minutes alive.

As far i have something like this :

alert tcp any any -> proxy 8080 (msg:"possible httptunnel"; dsize: >1000; )

How do i add a time option to check for xx minutes ?

Although actual i don't know exactly where to add this rule. As i am
using oinkmaster i guess this should be mentioned :)

any suggestions are very welcomed.

Thomas


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users