Re: [Snort-sigs] confused over thresholds

Russell Fulton wrote:
> Hi Folk,
>       I clearly don't understand this properly, sigh...
> I am getting lots (tens of thousands) of hits on the bleeding VNC rule:
>
> :alert tcp $EXTERNAL_NET any -> $HOME_NET 5900:5920 (msg: "BLEEDING-EDGE
> SCAN Potential VNC Scan 5900-5920"; flags:S; threshold: type threshold,
> track by_src, count 50, seconds 900; classtype:attempted-recon;
> sid:2002911; rev:1;)
>
> Astute people will notice that I have raised both the count and the
> seconds parameters to threshold in an attempt to cut down the number of
> alerts.
I think what you want is threshold: type both.  That will give one ONE
alert if you get 'count' hits in 'seconds', and no more until 'seconds'
are up.

Using type threshold, you get ONE alert for 'count' hits in 'seconds',
then everything is reset to scratch, and it starts looking for 'count'
hits in the next 'seconds' all over again.

Jeff


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs