4
alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Get2 method"; flow: to_server, established; dsize: >20; sid:1000006; priority: 15)

Snort does not generate any alert, whereas when I write the following rule:

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Get1 method"; flow: to_server, established; dsize: <20; sid:1000005; priority: 15)

it does generate alert

1

As Snort manual is claiming:

The dsize keyword is used to test the packet payload size. This may be used to check for abnormally sized packets that might cause buffer overflows.

This example looks for a dsize that is between 300 and 400 bytes.

dsize:300<>400;

So, this setup is causing the generation and the not-generation of the alert.

  • 1
    I think the OP is running only one version the alert, not both at once. – schroeder Oct 15 '15 at 18:09
  • @Schroeder I believe the point made by nick is that the dsize condition is not being satisfied when it is configured to be "dsize: >20". The implication is that the testing done by the OP does not provoke any packet with payload size greater than 20 bytes. – D.H. Jul 12 '16 at 11:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.