Using the learning platform, the subject is snort rules.

Question is:

Create a snort rule that will alert on traffic with destination ports 443 and 447.

My attempts:

alert tcp any any -> any 443 447 ( msg:"Sample alert"; sid:1; rev:1; )

alert tcp udp any any -> any 443 447 ( msg:"Sample alert"; sid:1; rev:1; )

My answer is wrong and I cant see why. Any pointers would be very much appreciated.

| improve this question | | | | |
  • If the answer provided helped, then upvote and click the check mark to accept and the answer. – schroeder Feb 7 '19 at 16:39

I had to solve this exact case for Immersive Labs! This is the rule you are looking for:

alert tcp any any -> any [443,447] ( msg:"Sample alert"; sid:1000001; rev:1; )

Also, I noticed your sid:1. All sid up to 1,000,000 are reserved. So your sid must be at least 1000001.

Note: there must not be any spaces in between each port in the list.

| improve this answer | | | | |

I'm not familiar with snort. However, the snort documentation gives this example:

alert tcp any any -> 80 ( msg:"A ha!"; content:"attack"; sid:1; )

The structure is:

action proto source dir dest ( body )

It also states, that:

source - specifies the sending IP address and port, either of which can be the keyword any, which is a wildcard.

dir - must be either unidirectional as above or bidirectional indicated by <>.

dest - similar to source but indicates the receiving end.

There is no indication made, that you can match multiple ports at once. I'd therefore try the following rules:

alert tcp any any -> any 443 ( msg:"Sample alert 443"; sid:1; rev:1; )

alert tcp any any -> any 447 ( msg:"Sample alert 447"; sid:2; rev:1; )

Edit: If your question was how to achieve this in one rule, you might want to try:

alert tcp any any -> any [443,447] ( msg:"Sample alert"; sid:1; rev:1; )

You will also probably find this site useful.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.