I am beginning to study Snort rules and the teacher give to us the next exercises:

A server on which Snort is installed is monitoring all traffic on subnet with mask From now on we are going to refer to this subnet as subnet_A. The student must write the Snort rules that allow registering the following events:

  1. Enter a rule that attempts to search for the word "HTTP" between characters 4 and 40 of the data part of any TCP packet originating in subnet_A and going to an address that is not part of sub_A. In the log file, the record must contain the message "HTTP Detected".

  2. Create two rules to detect when someone is trying to access a machine located in subnet_A whose IP address is to port 137 and both UDP and TCP protocols. When the indicated pattern is detected, the rule should send an alert with the message "Attempt to access port 137 and protocol ".

  3. It configures a single Snort rule that allows capturing the passwords used (PASS command) when connecting to file transfer services (FTP) or mail query (POP3) from the machine with IP address located in subnet_A. When the indicated pattern is detected, the rule should launch an alert with the message "Password detected".

These are my answers:

1.- alert tcp any -> ![] any \
(logto:logto_log.txt; content:"HTTP"; offset: 4; depth: 40; msg: "HTTP Detected";)

2.- alert tcp any any -> 137 \
(msg: "Attempt to access port 137 and protocol TCP";)

alert udp any any -> 137 \
(msg: "Attempt to access port 137 and protocol UDP";)

3.- alert tcp any -> any 110,995,20:21   \
(msg:"Password Detected"; content:"PASS";)

Would you agree with me?

  • Your examples violate the rule syntax in some cases. Please make sure you validate the basics.
    – schroeder
    Commented Feb 23, 2018 at 12:02

2 Answers 2


First 3 look good to me. I believe the 3rd needs to have the list of port numbers in square brackets. Check sid 2018383 in the link below to see an example.


Also for the 3rd, you might want to set a depth and offset so that any page with the content "PASS" (like this page) doesn't trigger a false positive.


I am also doing the same task and my answers are almost the same. From what I found in my brief research, when detailing the ports, you cannot list them. You either mark one or a range, with ":" to bridge them, so if you need to apply the ports for POP3 and FTP, I used 20:995.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .