Snort rules are the conditions specified by a Network Administrator that differentiate between normal Internet activities and malicious activities. Snort rules are made up of two basic parts:

* Rule header: This is the part of any rule where the rule’s actions are identified. Alert, Log, Pass, Activate, Dynamic, etc. are some important actions used in snort rules.
* Rule options: This is the part of any rule where the rule’s alert messages are identified.

For example: A Network Administrator has written the following rule:

Alert tcp any -> any 6667 (msg:”IRC port in use”; flow:from_client)

The first portion of the rule specifies the action, which is to examine port 6667 traffic. If a match occurs, a message should be generated that reads “IRC port is in use”, and the IDS would create a record that an IRC port might have been accessed.

Explore More

DDoS Attack on Myanmar Takes the Country Offline

The main Internet provider for Myanmar, the southeast Asian nation formerly known as Burma, has been under severe denial of service attack since at least October 25, according to the

Read More

Metasploit Framework 3.7.0 Released!

The Metasploit team has spent the last two months focused on one of the least-visible, but most important pieces of the Metasploit Framework; the session backend. Metasploit 3.7 represents a

Read More

Knowledge is power against hacker schemes

Most IT managers neglect to tell users how to avoid falling prey to the dangerous hacker technique of social engineering. Here’s what you need to know. In the past, social

Read More