Is it possible to write a snort rule that match on 2 different flows?

For instance on a communication from host-a <--> host-b that happen at the same time as a communication on host-a <--> host-c ?


The short answer is "no." Snort primarily operates on a stream-by-stream basis. But it would help to know specifically what you're trying to do.

If you only want to generate a single alert when both events happen and those two events are dissimilar, you cannot do this with a text rule. However, if you want to detect that host A does the same thing to host B and host C at the same time, you could use detection_filter with track by_src to see that the host is doing something it shouldn't.

The long answer is that you can do all sorts of things using shared object rules and abusing the power and flexibility that they give, but explaining this on a Web forum would be difficult.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.