Implementing a snort rule to track session duration

Dear all,

unfortunately my Snort knowledge is not deep enough to achieve the following
use case:

Alert if a session is not closed within 60 seconds after it has been opened.

 

As there is no configuration option for session duration, I was thinking
about alerting if there is no FIN flag received for a connection within 60
seconds after the SYN flag was sent (either via dynamic rules or flowbits). 

 

So the first rule would register that the session has been opened, e.g.

 

Alert tcp 192.168.1.0/24 any -> 192.168.2.20 22 (flags:S; msg:"Connection
established"; flowbits:set,established; sid:1900001; rev:1;)

 

The second rule should trigger if no FIN flag for this connection is
received but I only know about the positive rule:

 

Alert tcp 192.168.1.0/24 any -> 192.168.2.20 22 (flags:AF; msg:"Connection
closed"; flowbits:isset,established; flowbits:unset,established;
sid:1900002; rev:1; detection_filter: track by_src, count 1;seconds 60)

 

There are multiple questions that come to my mind:

*	How to achieve alerting on absence of a packet
*	How to guarantee that the rule triggers only if SYN and FIN are
related to the same session (e.g. if two sessions from different clients to
the server are established how to track each one separately). As configured
above the src is only tracked for the second rule independent of the first
rule
*	would the rule matching 1 FIN packet in the next 60 seconds matching
what I try to achieve (60 seconds after the SYN packet) or would it trigger
always as it does not start after the first alert rule
*	Would the rule be achievable via dynamic/activate rule or tagging
instead of the example above 

 

Thank you for any help.

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette