Re: Implementing a snort rule to track session duration

Hi.

To control session duration, a kind of timer should be available to generate an event in case of packet absence. Perhaps, the event may present a session context and a corresponding rule to evaluate.
AFAIK, Snort doesn't have a per-session timer available for rule evaluation. I don't see a way how to write "session expired" rule, except providing a new rule option (could be in a plugin form).

Have a nice day,
Alexey

On 3 Mar 2023, at 16:59, funkandreas85--- via Snort-users <[email protected]<mailto:[email protected]>> wrote:

Dear all,
unfortunately my Snort knowledge is not deep enough to achieve the following use case:
Alert if a session is not closed within 60 seconds after it has been opened.

As there is no configuration option for session duration, I was thinking about alerting if there is no FIN flag received for a connection within 60 seconds after the SYN flag was sent (either via dynamic rules or flowbits).

So the first rule would register that the session has been opened, e.g.

Alert tcp 192.168.1.0/24 any -> 192.168.2.20 22 (flags:S; msg:”Connection established”; flowbits:set,established; sid:1900001; rev:1;)

The second rule should trigger if no FIN flag for this connection is received but I only know about the positive rule:

Alert tcp 192.168.1.0/24 any -> 192.168.2.20 22 (flags:AF; msg:”Connection closed”; flowbits:isset,established; flowbits:unset,established; sid:1900002; rev:1; detection_filter: track by_src, count 1;seconds 60)

There are multiple questions that come to my mind:

  *   How to achieve alerting on absence of a packet
  *   How to guarantee that the rule triggers only if SYN and FIN are related to the same session (e.g. if two sessions from different clients to the server are established how to track each one separately). As configured above the src is only tracked for the second rule independent of the first rule
  *   would the rule matching 1 FIN packet in the next 60 seconds matching what I try to achieve (60 seconds after the SYN packet) or would it trigger always as it does not start after the first alert rule
  *   Would the rule be achievable via dynamic/activate rule or tagging instead of the example above


Thank you for any help.



_______________________________________________
Snort-users mailing list
[email protected]<mailto:[email protected]>
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

To unsubscribe, send an email to:
[email protected]<mailto:[email protected]>

Please visit http://blog.snort.org<http://blog.snort.org/> to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette