Snort, add TCP retransmission rule

Question

Can somebody help me with adding rule for packet retransmission.

I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission catches the original packet .

These are the packets for which I am trying to add the rule

This is the rule which suppose to catch the retransmission but also catches the original packets.

alert tcp any any -> <destinationAddress> 22 (msg:"SSH retransmission detected"; classtype: attempted0recon; sid: 999999)

Also, just for the sake of comparison, I want to try both rules to be mutual exclusive.

Thank you

Answer 1

Unless you've added a new custom attack class in your classification.config file with the name attempted0recon, there isn't any such class in Snort by default. There is however a class named attempted-recon.

You have also not set any additional filters for which the message "SSH retransmission detected" should be reported, so your example would read as:

Alert with class attempted0recon and message 'SSH retransmission detected' any inbound TCP connection to <destinationAddress> port 22 originating from any remote address and port.

I didn't write it in exact order, as that would make it utterly unreadable, but the general Snort rules form is:

action proto src_ip src_port direction dst_ip dst_port (options)

Your rule could thus read like this:

alert tcp any any -> <destinationAddress> 22 (msg:"SSH retransmission detected"; 
                                              content:"TCP Retransmission"; 
                                              nocase; 
                                              classtype:attempted-recon;)

for your rule in the example you provided. Since the other (first packet) rule can't depend on any payload contents (as I don't see any in your printout), you could for example use dsize keyword in the options part to identify them by their size and/or other non-payload detections:

alert tcp any any -> <destinationAddress> 22 (msg:"SSH key exchange"; 
                                              dsize: <518; 
                                              classtype:tcp-connection;)

Obviously, you could adopt these to suit your needs better and they are just examples.