2
votes
1answer
498 views

snort ignores packets with matching src/dest IP address

This is my rule: alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;) I am running snort against a precaptured packet file where there are UDP packets that ...
1
vote
1answer
614 views

Snort, add TCP retransmission rule

Can somebody help me with adding rule for packet retransmission. I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...