Re: Alert based on website URL

["Joel Esler (jesler)" <jesler () cisco com>]

Did you try this first?

https://github.com/vrtadmin/snort-faq/blob/master/FAQ/Im-not-receiving-alerts-in-Snort.md


On Jan 20, 2014, at 12:24 PM, Feroz Basir <feroz.basir () gmail com> wrote:

> Hi All,
>
> Anyone could help me on my basic snort rule, please? I've tried a few combination and nothing worked for me. Thanks.
>
> Regards,
> Feroz Basir
>
> > On 14 Jan 2014, at 10:34, Feroz Basir <feroz.basir () gmail com> wrote:
> >
> > Hi Nicholas,
> >
> > I copy n paste the rule into local.rules file. I still couldn't see any alert when I accessed www.facebook.com. Can 
> > you help, please? 
> >
> > Thanks again.
> >
> > Regards,
> > Feroz Basir
> >
> > > On 14 Jan 2014, at 02:40, "Nicholas Mavis (nmavis)" <nmavis () cisco com> wrote:
> > >
> > > Yes, they would work if you altered the content matches correctly. The
> > > byte_test verifies that the packet is a valid DNS request and Host|3A|
> > > would be part of the HTTP headers. If you have further questions regarding
> > > those content matches, I would recommend reading into DNS and HTTP
> > > protocols along with their typical header structure.
> > >
> > > > On 1/13/14 11:32 AM, "Feroz Basir" <feroz.basir () gmail com> wrote:
> > > >
> > > > Hi Nicholas,
> > > >
> > > > Thanks for replying. FYI, Facebook.com is just an example. Would that
> > > > work with other URL as well?
> > > >
> > > > What is that - Host|3A| ?
> > > >
> > > > Care to teach me on how you got - byte_test:1,!&,0xF8,2;  ?
> > > >
> > > > Thanks again. I have quite numbers of URL that I need to monitor and
> > > > using different port number as well.
> > > >
> > > > Regards,
> > > > Feroz Basir
> > > >
> > > > > On 14 Jan 2014, at 00:18, "Nicholas Mavis (nmavis)" <nmavis () cisco com>
> > > > > wrote:
> > > > >
> > > > > Feroz,
> > > > >
> > > > > The rules you have would not work for what you want to achieve. Here
> > > > > some
> > > > > some quick revisions to the rules you provided:
> > > > >
> > > > > alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Facebook
> > > > > http";
> > > > > content:"Host|3A| facebook.com"; fast_pattern: only;)
> > > > >
> > > > > alert udp $HOME_NET any -> any 53 (msg:"Facebook DNS";
> > > > > byte_test:1,!&,0xF8,2; content:"|08|facebook|03|com|00|"; fast_pattern:
> > > > > only;)
> > > > >
> > > > > $HOME_NET is defined as your internal network you are monitoring and
> > > > > $EXTERNAL_NET is typically set to "any". $HTTP_PORTS is set to the Snort
> > > > > defaults in my configuration.
> > > > >
> > > > > -Nick Mavis
> > > > >
> > > > >
> > > > >
> > > > > > On 1/12/14 1:04 PM, "Feroz Basir" <feroz.basir () gmail com> wrote:
> > > > > >
> > > > > > Hi All,
> > > > > >
> > > > > > I'm trying to monitor user/program accessing certain website on port 80
> > > > > > or different port. Would below rule work? Tried them but without any
> > > > > > success. Perhaps i missed something.
> > > > > >
> > > > > > Alert tcp any any -> any 80 (MSG: "user/program accessing Facebook";
> > > > > > content: "www.facebook.com")
> > > > > >
> > > > > > Or based on DNS query.
> > > > > >
> > > > > > Alert udp any any -> any 53 (MSG: "user/program accessing Facebook";
> > > > > > content: "www.facebook.com")
> > > > > >
> > > > > > Thanks.
> > > > > >
> > > > > > Regards,
> > > > > > Feroz Basir
> > > > > >
> > > > > > ------------------------------------------------------------------------
> > > > > > --
> > > > > > ----
> > > > > > CenturyLink Cloud: The Leader in Enterprise Cloud Services.
> > > > > > Learn Why More Businesses Are Choosing CenturyLink Cloud For
> > > > > > Critical Workloads, Development Environments & Everything In Between.
> > > > > > Get a Quote or Start a Free Trial Today.
> > > > > >
> > > > > > http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.cl
> > > > > > kt
> > > > > > rk
> > > > > > _______________________________________________
> > > > > > Snort-users mailing list
> > > > > > Snort-users () lists sourceforge net
> > > > > > Go to this URL to change user options or unsubscribe:
> > > > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > > > Snort-users list archive:
> > > > > > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> > > > > >
> > > > > > Please visit http://blog.snort.org to stay current on all the latest
> > > > > > Snort news!
>
> ------------------------------------------------------------------------------
> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
> Learn Why More Businesses Are Choosing CenturyLink Cloud For
> Critical Workloads, Development Environments & Everything In Between.
> Get a Quote or Start a Free Trial Today. 
> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
CenturyLink Cloud: The Leader in Enterprise Cloud Services.
Learn Why More Businesses Are Choosing CenturyLink Cloud For
Critical Workloads, Development Environments & Everything In Between.
Get a Quote or Start a Free Trial Today. 
http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!