From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules.
What if I wish to have a rule based on multiple packets such as analysis of a protocol situation that can maintain its states, e.g. TCP or TLS?
I am curious to know if I can select a group of packets that is part of a specific session using snort rules. I would like to analyse the contents of the packets with respect to the packets already received in order to prove or reject certain assumptions. E.g. Did the packets arrive with correct parameters and in order as expected by the protocol template?
Thanks to some feedback, I am trying to put out a detailed sketch of the problem. Here it is :
Let's assume a three-step protocol :
Message 1: Client -> Server : Hello, CS1
Message 2: Server -> Client : Hi, CS2, SS1
Message 3: Client -> Server : Wow, SS2
CS1 is Client Secret encrypted with Server public key
CS2 is Client Secret encrypted with client public key
SS1 is Server Secret encrypted with client public key
SS2 is Server Secret encrypted with Server public key
After the protocol run, both the parties are assured that they are talking to the legitimate partners. For now, I am ruling out the attacks.
Using Snort, I want to check the contents of the packets in order to see if any of the messages e.g. CS1/CS2/SS1/SS2 etc are ever replayed or check if all the messages followed the given ordered sequence (1,2,3) or not etc.