Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Snort rule to alert on a single IP port 80 traffic ??

Posted on 2004-09-02
3
Medium Priority
?
440 Views
Last Modified: 2012-06-27
I need to monitor a specific users traffic on port 80 and I would like to use a Snort alert rule so that the traffic is stored in mysql on my IDS box.

I have tried this simple rule but it does not work.  IP changed to protect the innocent :-)

alert tcp 10.x.x.x 80 -> any any (msg:"10.x.x.x Web Traffic Alert";)

Since my Snort box sits between the firewall and the main router, it is ideal for monitoring the traffic.

Can anyone give me a rule that will accomplish what I need?

Thanks,

Craig
0
Comment
Question by:Craig Sharp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 4

Accepted Solution

by:
syn_ack_fin earned 2000 total points
ID: 11965592
Try this one:
alert tcp 10.x.x.x any -> any 80
or if correct variables are set
alert tcp $HOME_NET any -> $EXTERNAL_NET 80

The source port will not be 80 the destination port will be.

Good luck.
0
 
LVL 3

Author Comment

by:Craig Sharp
ID: 11971551
Since I want to monitor traffic from a single source address, would I write the rule like this?

alert tcp 10.50.x.x any -> any 80 (msg:"10.50.x.x Web Traffic Alert";)
0
 
LVL 4

Expert Comment

by:syn_ack_fin
ID: 11992598
Yes, that should work. The only problem with your original rule was that the ports were switched. Your rule was looking for traffic with a source port of 80, not destination.
0

Featured Post

Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you're a modern-day technology professional, you may be wondering if certifications are really necessary. They are. Here's why.
A bad practice commonly found during an account life cycle is to set its password to an initial, insecure password. The Password Reset Tool was developed to make the password reset process easier and more secure.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question