Suppose i have not written rule for a type of attack in SNORT; It is obvious that it wont show any alerts. I wanna develop a system wherein i capture packets that SNORT allows n do further processing ...
This is my rule: alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;) I am running snort against a precaptured packet file where there are UDP packets that ...
Can somebody help me with adding rule for packet retransmission. I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...