Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it even possible to specify into a snort rule the duration of a connection?

For example: in this format Hour, Minute, Second

H, M, S = 0, 2, 1

If a connection that has the duration of 2 minutes and 1 second, then alert.

Or in this sense:

If a connection is longer than 10 seconds, then alert.

How do we implement the idea?

share|improve this question

1 Answer 1

Short answer: no.

Longer answer: If you've got coding chops, you basically need to add a new detection keyword that acts almost exactly like the threshold keyword, except it alerts for any packets after s seconds, rather than c packets within s seconds. This might be appealing if you're already building your sensors from source in your infrastructure. Not that hard -- a number of years ago, I rigged up a build for a customer that would actively reset brute force attacks from a given IP once reaching c count in s seconds.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.