Snort Rule Infographic
Snort Rule Infographic
Official Documentation
-----------------------------------------------------------
SNORTOLOGY 101
THE ANATOMY OF A SNORT RULE
WHAT IS SNORT?
Snort is an open source network intrusion prevention system (IPS) by Cisco. It is capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching and matching, and detect a variety of attacks and probes. Snort can be used as a straight packet sniffer like tcpdump, a packet logger (useful for network traffic debugging), or as a full-blown network intrusion prevention system.
LET’S BREAK IT DOWN
BASIC OUTLINE OF A SNORT RULE
[action][protocol][sourceIP][sourceport] -> [destIP][destport] ( [Rule options] )
|___________________ Rule Header _________________|
RULE HEADER
The rule header contains the rule's action, protocol,
source and destination IP addresses and netmasks,
and the source and destination ports information.
alert Action to take (option) The first item in a rule
is the rule action. The rule action tells Snort what to do
when it finds a packet that matches the rule criteria
(usually alert).
tcp Type of traffic (protocol) The next field in a rule
is the protocol. There are four protocols that Snort
currently analyzes for suspicious behavior
- TCP, UDP, ICMP, and IP.
$EXTERNAL_NET Source address(es) variable or literal
$HTTP_PORTS Source port(s) variable or literal
-> Direction operator The direction operator ->
indicates the orientation of the traffic to which
the rule applies.
$HOME_NET Destination address(es) variable or literal
any Destination port(s) variable or literal
RULE OPTIONS
Rule options form the heart of Snort’s intrusion detection engine combining ease of use with power and flexibility. All Snort rule options are separated from each other using a semicolon (;). Rule option keywords are separated from their arguments with a colon (:).
GENERAL RULE OPTIONS
Message A meaningful message typically includes what the rule is detecting.
The msg rule option tells Snort what to output when the rule matches.
It is a simple text string.
Flow For the rule to fire, specifies which direction the network traffic is going.
The flow keyword is used in conjunction with TCP stream reassembly.
It allows rules to only apply to certain directions of the traffic flow.
Reference The reference keyword allows rules to include references
to external sources of information.
Classtype The classtype keyword is how Snort shares what the effect
of a successful attack would be.
sid/rev The snort id is a unique identifier for each rule. This information
allows output plugins to identify rules easily and should be used with
the rev (revision) keyword.
DETECTION OPTIONS
Content This important feature allows the user to set rules that search for
specific content in the packet payload and trigger response based on that
data. The option data can contain mixed text and binary data.
distance/offset These keywords allow the rule writer to specify where
to start searching relative to the beginning of the payload or the
beginning of a content match.
within/depth These keywords allow the rule write to specify how far
forward to search relative to the end of a previous content match and,
once that content match is found, how far to search for it.
PCRE The pcre keyword allows rules to be written using perl compatible
regular expressions which allows for more complex matches than simple
content matches.
Byte test The byte_test options allows a rule to test a number of bytes
against a specific value in binary.
EXAMPLE Rule Header alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any Message msg: “BROWSER-IE Microsoft Internet Explorer CacheSize exploit attempt”; Flow flow: to_client,established; Detection file_data;
content:"recordset"; offset:14; depth:9;
content:".CacheSize"; distance:0; within:100;
pcre:"/CacheSize\s*=\s*/";
byte_test:10,>,0x3ffffffe,0,relative,string; Metadata policy max-detect-ips drop, service http; References reference:cve,2016-8077; Classification classtype: attempted-user; Signature ID sid:65535;rev:1;
例如:alert tcp any any -> any 80 (msg:"http critical file type(sh) Blocked"; content:".sh"; sid:10101; rev:1;)
=================== End
Snort Rule Infographic的更多相关文章
- SNORT入侵检测系统
SNORT入侵检测系统 YxWa · 2015/10/09 10:38 0x00 一条简单的规则 alert tcp 202.110.8.1 any -> 122.111.90.8 80 (ms ...
- How to compile and install Snort from source code on Ubuntu
http://www.tuicool.com/articles/v6j2Ab Snort is by far the most popular open-source network intrusio ...
- 如何编写snort的检测规则
如何编写snort的检测规则 2013年09月08日 ⁄ 综合 ⁄ 共 16976字 前言 snort是一个强大的轻量级的网络入侵检测系统.它具有实时数据流量分析和日志IP网络数据包的能力,能够进行协 ...
- Snort Inline IPS Mode
Snort Inline IPS Mode https://forum.netgate.com/topic/143812/snort-package-4-0-inline-ips-mode-intro ...
- snort_inline
snort_inline Link http://snort-inline.sourceforge.net/oldhome.html What is snort_inline? snort_inl ...
- BlackArch-Tools
BlackArch-Tools 简介 安装在ArchLinux之上添加存储库从blackarch存储库安装工具替代安装方法BlackArch Linux Complete Tools List 简介 ...
- snort installation, configuration and test
snort installation: https://www.snort.org/#get-started wget https://www.snort.org/rules/snortrules-s ...
- Snort - 配置文件
Snort.conf 版本 2.9.8.3 编译可用选项: --enable-gre --enable-mpls --enable-targetbased --enable-ppm --enable- ...
- Snort - manual 笔记(一)
Chapter 1 Snort Overview This manual is based on Writing Snort Rules by Martin Roesch and further wo ...
随机推荐
- macos下如何解决无法写ntfs格式的u盘或硬盘?
答:macos原生支持,可以通过脚本卸载再重新挂载为可读写即可,脚本在此
- DMA与PIO是什么东西?
1. DMA全称是什么? Direct Memory Access 2. PIO全称是什么? Programming Input/Output 3. DMA与PIO是两种不同的模式 3.1 DMA 不 ...
- YII2 composer update 报错解决一例-requires bower-asset/jquery 2.2
➜ yii-advanced composer update Loading composer repositories with package information Updating depe ...
- Mapbox显示地图案例
mapbox地图入门案例 <!DOCTYPE html> <html> <head> <meta charset='utf-8' /> <titl ...
- 从0开始学爬虫8使用requests/pymysql和beautifulsoup4爬取维基百科词条链接并存入数据库
从0开始学爬虫8使用requests和beautifulsoup4爬取维基百科词条链接并存入数据库 Python使用requests和beautifulsoup4爬取维基百科词条链接并存入数据库 参考 ...
- centos6.8安装python3.7.3报错Can't connect to HTTPS URL because the SSL module is not available问题解决
环境:CentOS release 6.8 (Final) # 直接编译python3.7在使用pip3安装依赖的时候报错: Can't connect to HTTPS URL because th ...
- spark.sql.shuffle.partitions和spark.default.parallelism的区别
在关于spark任务并行度的设置中,有两个参数我们会经常遇到,spark.sql.shuffle.partitions 和 spark.default.parallelism, 那么这两个参数到底有什 ...
- Cheng MeiChun团队的技术支持
本网页为Cheng MeiChun团队的技术支持网址,如果在我们开发的游戏中遇到任何问题,欢迎联系我们! QQ:1505478990 邮箱:1505478990@qq.com
- Python - Django - ORM QuerySet 方法补充
models.py: from django.db import models class Employee2(models.Model): name = models.CharField(max_l ...
- Python - Django - simple_tag 和 inclusion_tag
simple_tag: simple_tag 和自定义 filter 类似,但可以接收更多更灵活的参数 在 app01/templatetags/ 目录下创建 mysimple_tag.py mysi ...