Write rules Snort

[Iliass Hakim <iliass61 () hotmail com>]

Hi all,
I am a new snort user. Current implementation is snort-2.9.2 on Ubuntu 12.04 TLS.
My question is what can be write
rules to determine if saturation has occurred on the network and its cause i.e.
the number 
of packets sent, received and lost 
If yes How?
best  


Regards,
Thanks

------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!