The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?


Snort looks at network activity, so it would have to be something that the client-side app sends over the network. At that point, you would need to look at the messages that the client sends out, which could be grabbed by Snort. Pre-defined? No, there are too many client-side apps to catch them all.

Snort rule template:

alert tcp any any -> any 80 (msg: "Client Unhappy";content:"Client unhappy text";nocase;)

This rule is pretty basic, but it's the place to start. To reduce false positives, you would also want to look at the ports the client and server use to communicate messages and refine your rules to look there.

Here is a SANS guide on how to look for certain text, and refinements.

  • Thanks, I know I could define a rule for just about anything. I just wasn't sure if a rule existed for 'client side app alert' – RobotHumans Mar 22 '12 at 16:59
  • I don't think there could be. There is no standard for error messages above layer 4, so you would have to write your own and grep through the data. The definition of 'fishy' would be application-dependent and not common between applications. – schroeder Mar 22 '12 at 18:39
  • Thanks I think you nailed it more in the question with 'No, there are too many client-side apps to catch them all'. And no there is no standard rule for appname field thinks eventid Y is causing problem level z. – RobotHumans Mar 22 '12 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.