If this was TCP traffic, then it'd be easy.... With UDP it's a little
difficult. See if you can find something in the payload to identify a
session start for the application itself. Otherwise, you can play
around with thresholding, track by source and log one every 15
minutes, or every half hour, or whatever. The problem here is that
you might miss some new connections that occur within that time
window.
Your best bet is to look in the application level for some identifying
information. Ethereal is your friend.
On Sun, 19 Dec 2004 16:15:25 +0100, Klemen Mihevc <mafia-x@volja.net> wrote:
Hello,
I'm kinda new in »advanced« snort configuration. Until now i only used it
with »default« cfg & rules. Now i have a problem, I'm runing on linux server
2 gameservers on udp port 27960 & 28960 i made 2 custom rules to track that
connections:
alert udp $EXTERNAL_NET any -> $HOME_NET 27960 (msg:"Enemy Territory
player";)
alert udp $EXTERNAL_NET any -> $HOME_NET 28960 (msg:"Call of Duty player";)
now i have a problem couse every packet is logged (and logs are huge) even
if it's only about 1k big and it is product of outside scan of server not
actual connection to it. Is there anyway to log only first and last package
from 1 ip and only if data transfer is bigger then let's say 5k? Or maybe
anyother way to log that connections? I also tryed with chaosreader &
tcpdump but this method is too much cpu & ram consuming and i also tried
with iptable but again with same problem (every package is logged). I relay
wanna use snort because i can use mysql & acid for statistic...
Thx
PS: sorry for my bad english ;)
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
