Differences

This shows you the differences between two versions of the page.

--- ids:snort:snort_rule_format [2021/07/26 08:40] – [Snort Rule] peter
+++ ids:snort:snort_rule_format [2021/07/26 08:46] (current) – peter
@@ Line 1: / Line 1: @@
 ====== IDS - Snort - Snort Rule Format ======
-===== Snort Rule =====
+===== Snort Rule Header =====
+|Action|Protocol|Source Address|Source Port|Direction|Destination Address|Destination Port|
+<WRAP info>
+**NOTE:**
+  * Action:
+    * **alert**:  Display an alert.
+    * **log**:  Write to Log.
+    * **pass**:  Pass.
+  * Direction:
+    * **->**:  Inwards.
+    * **<-**:  Outwards.
+    * **<>**:  Either direction.
+</WRAP>
+----
+===== Sample Rule =====
 <code>
-alert tcp any 21 -> 192.168.1.123 any (msg: "TCP Packet is Detected";sid:100010)
+alert tcp any any -> any any(msg: "Testing Alert" ; sid:1000001)
+alert tcp any 21 -> 192.168.1.123 any (msg: "TCP Packet on Port 21 is Detected";sid:100010)
+log tcp !192.168.0/24 any -> 192.168.0.33 (msg: "Remote access" ; )
+log tcp any any -> 192.168.1.0/24 !6000:6010
 </code>
@@ Line 11: / Line 40: @@
   * Rule Header:
-|Action|Protocol|Source Address|Source Port|Direction|Destination Address|Destination Port|
   * Rule Option:
-    * The msg.
 </WRAP>