Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Can somebody help me with adding rule for packet retransmission.

I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission catches the original packet .

These are the packets for which I am trying to add the rule enter image description here

This is the rule which suppose to catch the retransmission but also catches the original packets.

alert tcp any any -> <destinationAddress> 22 (msg:"SSH retransmission detected"; classtype: attempted0recon; sid: 999999)

Also, just for the sake of comparison, I want to try both rules to be mutual exclusive.

Thank you

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Unless you've added a new custom attack class in your classification.config file with the name attempted0recon, there isn't any such class in Snort by default. There is however a class named attempted-recon.

You have also not set any additional filters for which the message "SSH retransmission detected" should be reported, so your example would read as:

Alert with class attempted0recon and message 'SSH retransmission detected' any inbound TCP connection to <destinationAddress> port 22 originating from any remote address and port.

I didn't write it in exact order, as that would make it utterly unreadable, but the general Snort rules form is:

action proto src_ip src_port direction dst_ip dst_port (options)

Your rule could thus read like this:

alert tcp any any -> <destinationAddress> 22 (msg:"SSH retransmission detected"; 
                                              content:"TCP Retransmission"; 
                                              nocase; 
                                              classtype:attempted-recon;)

for your rule in the example you provided. Since the other (first packet) rule can't depend on any payload contents (as I don't see any in your printout), you could for example use dsize keyword in the options part to identify them by their size and/or other non-payload detections:

alert tcp any any -> <destinationAddress> 22 (msg:"SSH key exchange"; 
                                              dsize: <518; 
                                              classtype:tcp-connection;)

Obviously, you could adopt these to suit your needs better and they are just examples.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.