CODEWITHSUNDEEP
network-programmingsystem-administrationsnort
privacyninja
privacyninja

Reputation: 81

Configuring rules to detect SMTP, HTTP and DNS traffic

I am currently trying to configure the Snort rules to detect SMTP, HTTP and DNS traffic. Is this setup correctly?

alert icmp any any -> $HOME_NET any (msg: "ICMP connection attempt"; sid:100000$
alert tcp any any -> $HOME_NET 80 (msg:"HTTP connection attempt"; sid:1000003; $
alert udp any any -> 10.8.9.39 any (msg: "DNS connection attempt"; sid:1000004;$
alert tcp $SMTP_SERVERS any -> $HOME_NET any (msg:"SMTP connection attempt"; si$

Upvotes: 1

Views: 2707

Answers (1)

privacyninja
privacyninja

Reputation: 81

These rules ended up being correct. The documentation can be found at: https://www.snort.org/documents

Upvotes: 1

Related Questions