4 
alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Get2 method"; flow: to_server, established; dsize: >20; sid:1000006; priority: 15)

Snort does not generate any alert, whereas when I write the following rule: 

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Get1 method"; flow: to_server, established; dsize: <20; sid:1000005; priority: 15)

it does generate alert

Improve this question

1 Answer 1

Reset to default
1

As Snort manual is claiming:

The dsize keyword is used to test the packet payload size. This may be used to check for abnormally sized packets that might cause buffer overflows.

This example looks for a dsize that is between 300 and 400 bytes.

dsize:300<>400;

So, this setup is causing the generation and the not-generation of the alert.

Improve this answer
2
  • 1
    I think the OP is running only one version the alert, not both at once.
    – schroeder ♦
    Commented Oct 15, 2015 at 18:09
  • @Schroeder I believe the point made by nick is that the dsize condition is not being satisfied when it is configured to be "dsize: >20". The implication is that the testing done by the OP does not provoke any packet with payload size greater than 20 bytes.
    – D.H.
    Commented Jul 12, 2016 at 11:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .