Enormous amount of alerts
Christian Leclerc <[email protected]> Thu, 4 Jul 2019 09:29:43 -0400
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CA+VMzsKUoQ=Egv-XpnCd0PNqe_jLxOxbmzNyYUn4EWFr6=1E+Q@mail.gmail.com> |
Hello guy's ! I have created a plugin in snort3 and it's very interesting how much data I can get for it. The problem is that if for example, I start a torrent, it logs on every packet. The same alert is triggered for the same ip and the same source so many times. Example: 2019-07-03 22:16:36 3 localhost 17.174.1.5:443 (tcp) experimental TCP options found 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP options found 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP options found 2019-07-03 22:16:36 3 localhost 17.174.1.5:443 (tcp) experimental TCP options found 2019-07-03 22:16:36 3 localhost 17.174.1.5:443 (tcp) experimental TCP options found 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP options found 2019-07-03 22:16:36 3 localhost 17.174.1.5:443 (tcp) experimental TCP options found 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP options found 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP options found 2019-07-03 22:16:36 3 localhost 17.174.1.5:443 (tcp) experimental TCP options found 2019-07-03 22:16:36 3 localhost 17.174.1.5:443 (tcp) experimental TCP options found 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP options found 2019-07-03 22:16:36 3 localhost 17.174.1.5:443 (tcp) experimental TCP options found 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP options found 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP options found 2019-07-03 22:16:36 3 localhost 17.174.1.5:443 (tcp) experimental TCP options found Is someone know how to adjust the trigger in the configuration to alert only once if it's the same alerts for every other packets after ? cheers, Christian L. _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!