Re: Enormous amount of alerts

Sounds like you want a threshold on the amount of alerts you receive within a given time (or count) of an event.

Check the documentation in the download for snort3


For snort2  you can check here:

http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node35.html




Albert Lewis
ENGINEER.SOFTWARE ENGINEERING
Cisco Systems Inc.
Email: [email protected]<mailto:[email protected]>



From: Snort-devel <[email protected]> on behalf of Christian Leclerc <[email protected]>
Date: Thursday, July 4, 2019 at 9:47 AM
To: "[email protected]" <[email protected]>
Subject: [Snort-devel] Enormous amount of alerts

Hello guy's !
I have created a plugin in snort3 and it's very interesting how much data I can get for it.
The problem is that if for example, I start a torrent, it logs on every packet. The same alert is triggered for the same ip and the same source so many times.


Example:

2019-07-03 22:16:36
3
localhost
17.174.1.5:443<http://17.174.1.5:443>
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
17.174.1.5:443<http://17.174.1.5:443>
localhost
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
17.174.1.5:443<http://17.174.1.5:443>
localhost
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
localhost
17.174.1.5:443<http://17.174.1.5:443>
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
localhost
17.174.1.5:443<http://17.174.1.5:443>
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
17.174.1.5:443<http://17.174.1.5:443>
localhost
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
localhost
17.174.1.5:443<http://17.174.1.5:443>
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
17.174.1.5:443<http://17.174.1.5:443>
localhost
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
17.174.1.5:443<http://17.174.1.5:443>
localhost
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
localhost
17.174.1.5:443<http://17.174.1.5:443>
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
localhost
17.174.1.5:443<http://17.174.1.5:443>
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
17.174.1.5:443<http://17.174.1.5:443>
localhost
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
localhost
17.174.1.5:443<http://17.174.1.5:443>
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
17.174.1.5:443<http://17.174.1.5:443>
localhost
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
17.174.1.5:443<http://17.174.1.5:443>
localhost
(tcp) experimental TCP options found
2019-07-03 22:16:36
3
localhost
17.174.1.5:443<http://17.174.1.5:443>
(tcp) experimental TCP options found
Is someone know how to adjust the trigger in the configuration to alert only once if it's the same alerts for every other packets after ?

cheers,
Christian L.

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!