Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?

share|improve this question
up vote 1 down vote accepted

Snort looks at network activity, so it would have to be something that the client-side app sends over the network. At that point, you would need to look at the messages that the client sends out, which could be grabbed by Snort. Pre-defined? No, there are too many client-side apps to catch them all.

Snort rule template:

alert tcp any any -> any 80 (msg: "Client Unhappy";content:"Client unhappy text";nocase;)

This rule is pretty basic, but it's the place to start. To reduce false positives, you would also want to look at the ports the client and server use to communicate messages and refine your rules to look there.

Here is a SANS guide on how to look for certain text, and refinements.

share|improve this answer
Thanks, I know I could define a rule for just about anything. I just wasn't sure if a rule existed for 'client side app alert' – RobotHumans Mar 22 '12 at 16:59
I don't think there could be. There is no standard for error messages above layer 4, so you would have to write your own and grep through the data. The definition of 'fishy' would be application-dependent and not common between applications. – schroeder Mar 22 '12 at 18:39
Thanks I think you nailed it more in the question with 'No, there are too many client-side apps to catch them all'. And no there is no standard rule for appname field thinks eventid Y is causing problem level z. – RobotHumans Mar 22 '12 at 19:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.