how to write a snort rule to alert traffic that does not find any matched rules

Question

Snort in IDS mode:

If there is some traffic that does NOT find any matched rule against all existing Snort rules, how would you write a bottom rule to alert this traffic?

Answer 1

I'm sorry, but Snort is not really designed for that. It sounds like you're wanting something more like a firewall.

Snort is an Intrusion Detection System, whose job is to highlight on suspicious or malicious traffic that it observes in order to inform those who monitor the network to, "Look over here!" Alerting on every single piece of traffic that passes by is pretty much the opposite of what Snort is supposed to do.

There are other solutions that would be better suited for what you're asking.

• If you're looking for metadata only, a firewall with the ability to log would be perfect. You can simply put an "allow any -> any log" rule at the bottom and then you'll have a log file with all of the metadata for each connection.

• If you're wanting to capture the actual traffic that is observed regardless of whether it fires a rule or not, you'd probably want to set up a packet capture utility with the ability to rotate log files. Many homegrown security devices are built this way so that security researchers can examine traffic that their IDS may have missed. For high bandwidth connections, people use something like netsniff-ng. If you're looking for something that not only captures the traffic but also gives you an interface to use to examine and download pcap, check out http://molo.ch/ which is free.

Answer 2

I don't know if this will work but you can use a generic regular expression on the pcre:"/^.*$/" parameter that will match anything if the regex is wrote correctly :).