Re: [Snort-sigs] Connecting signatures?

On Sun, 29 Aug 2004, Erik Fichtner wrote:
> On Sun, Aug 29, 2004 at 09:02:43AM +0200, Chris Kronberg wrote:
> >    I'm trying to find a way to write rules provding the following:
> >    Rule1 fires and sets another rule active, which fires on the
> >    following traffic (if the criteria are met). Rule2 should never
> >    fire without rule1 firing first.
>
> Sounds like you want flowbits.
>
> example:
>
> alert tcp any any -> any any (msg:"rule1"; content:"FOO"; flowbits: 
> set,saw_foo;);
> alert tcp any any -> any any (msg:"rule2"; content:"BAR"; flowbits: 
> isset,saw_foo;);

  Great! Thank you very much. Works like charm.  :-)

> For more advanced rule progression like this, you might want to take a look at
> Shoki (shoki.sourceforge.net).   It's very very young, but I think it will fill
> the gap between Snort and NFR if only people give it a little attention.
> (and you know, no one says you have to have ONLY ONE IDS on your network...)

  True. I'll take a look at Shoki.

  Cheers,


                                                       Chris Kronberg.



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs