Re: Snort-devel Digest, Vol 25, Issue 1

Hello Al
Thanks for the reply !! Yes it is exactly what I need for snort 3.

I know that with the documentation, I need to update this :

-- use latency to monitor / enforce packet and rule thresholds
latency =
{
    packet = { max_time = 1500 },
    rule = { max_time = 200 },
}

But my question is more related on , what would be the best values for
these latency parameter.

Christian Leclerc, CSSLP, CEH, OCMJEA, OCPJBCD, SCJP, ZCE
[email protected]

Sphere 3 Solutions inc.
No. d'entreprise: 842171969
Tél.: 514-940-1067
http://www.sphere3solutions.com

*CONFIDENTIALITÉ* L'information apparaissant dans ce message électronique
est de nature légalement privilégiée et confidentielle. Si ce message vous
est parvenu par erreur et que vous n'êtes pas le destinataire visé, vous
êtes par les présentes avisé que tout usage, copie ou distribution de ce
message est strictement interdit. Vous êtes donc prié de nous informer
immédiatement de cette erreur et de détruire ce message.

*CONFIDENTIALITY* The information in this message is legally privileged and
confidential. In the event of a transmission error and if you are not the
individual or entity mentioned above, you are hereby advised that any use,
copying or reproduction of this document is strictly forbidden. Please
advise us of this error and destroy this message.


On Thu, Jul 4, 2019 at 10:11 AM <[email protected]> wrote:

> Send Snort-devel mailing list submissions to
>         [email protected]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://lists.snort.org/mailman/listinfo/snort-devel
> or, via email, send a message with subject or body 'help' to
>         [email protected]
>
> You can reach the person managing the list at
>         [email protected]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Snort-devel digest..."
>
>
> Today's Topics:
>
>    1. Enormous amount of alerts (Christian Leclerc)
>    2. Re: Enormous amount of alerts (Al Lewis (allewi))
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Thu, 4 Jul 2019 09:29:43 -0400
> From: Christian Leclerc <[email protected]>
> To: [email protected]
> Subject: [Snort-devel] Enormous amount of alerts
> Message-ID:
>         <CA+VMzsKUoQ=Egv-XpnCd0PNqe_jLxOxbmzNyYUn4EWFr6=
> [email protected]>
> Content-Type: text/plain; charset="utf-8"
>
> Hello guy's !
> I have created a plugin in snort3 and it's very interesting how much data I
> can get for it.
> The problem is that if for example, I start a torrent, it logs on every
> packet. The same alert is triggered for the same ip and the same source so
> many times.
>
>
> Example:
>
> 2019-07-03 22:16:36 3 localhost 17.174.1.5:443 (tcp) experimental TCP
> options found
> 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP
> options found
> 2019-07-03 22:16:36 3 17.174.1.5:443 localhost (tcp) experimental TCP
> options found
> 2019-07-03 22:16:36 3 localhost
> 17.174.1.5:443 (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 localhost
> 17.174.1.5:443 (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 17.174.1.5:443 localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 localhost
> 17.174.1.5:443 (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 17.174.1.5:443 localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 17.174.1.5:443 localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 localhost
> 17.174.1.5:443 (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 localhost
> 17.174.1.5:443 (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 17.174.1.5:443 localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 localhost
> 17.174.1.5:443 (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 17.174.1.5:443 localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 17.174.1.5:443 localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36 3 localhost
> 17.174.1.5:443 (tcp) experimental TCP options found
> Is someone know how to adjust the trigger in the configuration to alert
> only once if it's the same alerts for every other packets after ?
>
> cheers,
> Christian L.
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://lists.snort.org/pipermail/snort-devel/attachments/20190704/7edf3432/attachment-0001.html
> >
>
> ------------------------------
>
> Message: 2
> Date: Thu, 4 Jul 2019 14:07:54 +0000
> From: "Al Lewis (allewi)" <[email protected]>
> To: Christian Leclerc <[email protected]>,
>         "[email protected]" <[email protected]>
> Subject: Re: [Snort-devel] Enormous amount of alerts
> Message-ID: <[email protected]>
> Content-Type: text/plain; charset="utf-8"
>
> Sounds like you want a threshold on the amount of alerts you receive
> within a given time (or count) of an event.
>
> Check the documentation in the download for snort3
>
>
> For snort2  you can check here:
>
> http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node35.html
>
>
>
>
> Albert Lewis
> ENGINEER.SOFTWARE ENGINEERING
> Cisco Systems Inc.
> Email: [email protected]<mailto:[email protected]>
>
>
>
> From: Snort-devel <[email protected]> on behalf of
> Christian Leclerc <[email protected]>
> Date: Thursday, July 4, 2019 at 9:47 AM
> To: "[email protected]" <[email protected]>
> Subject: [Snort-devel] Enormous amount of alerts
>
> Hello guy's !
> I have created a plugin in snort3 and it's very interesting how much data
> I can get for it.
> The problem is that if for example, I start a torrent, it logs on every
> packet. The same alert is triggered for the same ip and the same source so
> many times.
>
>
> Example:
>
> 2019-07-03 22:16:36
> 3
> localhost
> 17.174.1.5:443<http://17.174.1.5:443>
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> 17.174.1.5:443<http://17.174.1.5:443>
> localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> 17.174.1.5:443<http://17.174.1.5:443>
> localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> localhost
> 17.174.1.5:443<http://17.174.1.5:443>
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> localhost
> 17.174.1.5:443<http://17.174.1.5:443>
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> 17.174.1.5:443<http://17.174.1.5:443>
> localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> localhost
> 17.174.1.5:443<http://17.174.1.5:443>
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> 17.174.1.5:443<http://17.174.1.5:443>
> localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> 17.174.1.5:443<http://17.174.1.5:443>
> localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> localhost
> 17.174.1.5:443<http://17.174.1.5:443>
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> localhost
> 17.174.1.5:443<http://17.174.1.5:443>
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> 17.174.1.5:443<http://17.174.1.5:443>
> localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> localhost
> 17.174.1.5:443<http://17.174.1.5:443>
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> 17.174.1.5:443<http://17.174.1.5:443>
> localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> 17.174.1.5:443<http://17.174.1.5:443>
> localhost
> (tcp) experimental TCP options found
> 2019-07-03 22:16:36
> 3
> localhost
> 17.174.1.5:443<http://17.174.1.5:443>
> (tcp) experimental TCP options found
> Is someone know how to adjust the trigger in the configuration to alert
> only once if it's the same alerts for every other packets after ?
>
> cheers,
> Christian L.
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://lists.snort.org/pipermail/snort-devel/attachments/20190704/243c0d51/attachment.html
> >
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> Snort-devel mailing list
> [email protected]
> https://lists.snort.org/mailman/listinfo/snort-devel
>
>
> ------------------------------
>
> End of Snort-devel Digest, Vol 25, Issue 1
> ******************************************
>

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!