Re: Snort: how to block by binder using service keyword ?

Hi,

Snort3 currently does not support it.

Thanks,
Maya

From: Snort-users <[email protected]> on behalf of Meridoff via Snort-users <[email protected]>
Reply-To: Meridoff <[email protected]>
Date: Thursday, March 3, 2022 at 9:34 AM
To: "[email protected]" <[email protected]>
Subject: [Snort-users] Snort: how to block by binder using service keyword ?

Hello, I have snort3 and I want to block telnet traffic on any port.

In wizard there are default recognition of telnet service.

But blocking using binder rule doesn't work. It is only works if I specifies port (23).

Such config can block successfully:

binder = {}
wizard = default_wizard
binder[1] = { when = { proto="tcp",dst_ports="23", }, use = { action = "block"}}
binder[2]={ use = { type = "telnet" }, when = { service = "telnet" } }
binder[3]={ use = { type = "wizard" } }

Such config can not block:


binder = {}
wizard = default_wizard
binder[1] = { when = { service="telnet", }, use = { action = "block"}}
binder[2]={ use = { type = "wizard" } }

Thanks for replay..

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette