Writing Rules


VisualSniffer can analyze network traffic for matches against a user defined rule set and give warning messages based upon what it sees. VisualSniffer uses rules similar to Snort rules, which are explained at www.snort.org. VisualSniffer rules consist of two logical sections, the rule header and the rule options. The rule option section is enclosed in parenthesis and contains one or more options, which could be messages or patterns on which parts of the packet should be inspected. Rule options are separated from each other using the semicolon ; character.

header (option1; option2; ...)

The followings are two sample rules:
tcp any any -> any 21 (msg:"FTP DELE overflow attempt";content:"DELE "; nocase; content:!"|0a|"; within:100;)
tcp any any -> any 21 (msg:"FTP CWD ~root attempt"; content:"CWD "; content:" ~root"; nocase;)
To write rules, click on the Rule Manager button to popup the Rule Manager dialog.VisualSniffer separates rules in 27 groups with hundreds of built-in rules. To apply a rule in capturing packets, check the check box in front of the rule. You can add your own rules into any of these groups, or modify any built-in rules based on your network settings.To add a new rule, click on the new button, or to edit a rule, click on the edit button. Both actions will popup the rule edit dialog. In the dialog, you can define both the "Rule Header" and "Rule Options".

Rule header

The rule header contains protocol, source IP addresses, source port, direction, destination IP addresses, and the destination ports.

1. Protocol: The first field in a rule is the protocol. This field could be one of the followings: tcp, udp, icmp, and ip.
2. IP addresses: In the second field and fifth field, you should define the source and destination IP addresses. you can give a IP address or "any" for all IP addresses. If you want VisualSniffer to check a range of addresses, you can use a block mask. A block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address. For example, 216.104.129.100/24 would signify the block of addresses from 216.104.129.1 to 216.104.129.255. You may also specify lists of IP addresses. An IP list is specified by enclosing a comma separated list of IP addresses within square brackets.
tcp [216.104.129.0/24,10.1.1.0/24] any -> any 111 (content: "|00 01 86 a5|"; msg: "external mounted access";)
There is an operator that can be applied to IP addresses, the negation operator. If you want VisualSniffer to match any IP address except the those showed in the address fields, you can add a negation operator (!) before the address.
tcp !216.104.129.0/24 any -> any any (flags:S+; msg:"SYN packet";symbol:"SYN";)
3. Port Numbers: In the third field and sixth field, you should define the source and destination ports. you can give a number or "any" for all ports. If you want VisualSniffer to check a range of ports, you can use a range operator ':'. For example, 1:200 indicates port ranging from 1 to 200; :60 means all ports less than or equal to 60; 500: represents ports greater than or equal to 500.
4. Direction: There are two direction operators, -> and <>. The direction operator -> indicates the IP address and port numbers on the left side of the direction operator is from the source host, and the address and port information on the right side of the operator is the destination host. The bi-directional operator <> tells VisualSniffer to consider the address/port pairs in either the source or destination orientation.

Rule Options

A rule option consists of keyword and parameter. option keyword is separated from its argument with a colon ':' character. VisualSniffer rules support the following options:
1. msg - shows a message in the packet decoded view. It's parameter is a simple text string. For example, msg: "SYN packet".
2. ttl - test the IP header's TTL field value. This option keyword was intended for use in the detection of traceroute attempts. It's parameter is a number and preceded by one of the following operators: !, >, <, >=, and <=. These operators are optional. If there is no operator, the test will only be successful on an exact match.
3. tos - test the IP header's TOS field value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
4. id - test the IP header's fragment ID field for a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
5. ipoption - watch the IP option fields for specific codes. Valid parameters to this option are:
  • rr - Record route
  • eol - End of list
  • nop - No op
  • ts - Time Stamp
  • sec - IP security option
  • lsrr - Loose source routing
  • ssrr - Strict source routing
  • satid - Stream identifier
  • 6. fragbits - test the fragmentation bits of the IP header. There are three bits that can be checked, the Reserved Bit (R), More Fragments (M) bit, and the Don't Fragment (D) bit. You can use '+' or '-' to indicate a bit is set or no. You can also test one or more bits. For example, R+M- means to match Reserved Bit on and More Fragments bit off; D- matches Don't Fragment bit is no set.
    7. dsize - test the packet's payload size against a value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
    8. flags - test the TCP flags for certain values. There are six bits that can be checked,
  • F - FIN
  • S - SYN
  • R - RST
  • P - PSH
  • A - ACK
  • U - URG

  • You can use '+' or '-' to indicate a bit is set or no. You can also test one or more bits. For example, F+A- means to match FIN Bit on and ACK bit off; P- matches PSH bit is no set.
    9. seq - test the TCP sequence number field for a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
    10. ack - test the TCP acknowledgement field for a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
    11. itype - test the ICMP type field against a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
    12. icode - test the ICMP code field against a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
    13. icmp_id - test the ICMP ECHO ID field against a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
    14. icmp_seq - test the ICMP ECHO sequence number against a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
    15. content - search for a pattern in the packet's payload. The option data for the content keyword can contain mixed text and binary data. The binary data is generally enclosed within the pipe (|) character and represented as bytecode. Bytecode represents binary data as hexadecimal numbers. For example, content:"|90C8 C0FF FFFF|/bin/sh". Multiple content rules can be specified in one rule. This allows to match complex patterns. If the rule is preceded by a !, it matches all packets that do not contain this content.
    16. offset - modifier for the content option, sets the offset to begin attempting a pattern match. It's parameter is a number.
    17. depth - modifier for the content option, sets the maximum search depth for a pattern match attempt. It's parameter is a number.
    18. nocase - match the preceding content string with case insensitivity. This option has no parameter.
    19. ip_proto - IP header's protocol value. It's parameter is a number.
    20. sameip - determines if source ip equals the destination ip. This option has no parameter.
    21. distance - forcing relative pattern matching to skip space. It's parameter is a number.
    22. within - forcing relative pattern matching to be within a count. It's parameter is a number.
    23. tcpres - test the TCP reserved field. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match.
    24. symbol - shows a symbol in the packet list view. It's parameter is a simple text string. For example, symbol: "SYN".

    Setting Alarm

    You can create an alarm with a rule. When a captured packet matched the rule, it will trigger the alarm.
    1. click on the Set Rules button or select Options -> Rules... from the menu.
    2. In the Rule Edit dialog, select the rule that you want to set an alarm. button.
    3. Select the Set Alarm button
    4. In the "Alarm Setup" dialog, enter the following information:
  • Events needed to trigger - Specify the number of times the expected event must occur before the alarm is triggered.
  • Times to trigger - Specify the number of times your alarm may be triggered before the deactivation.
  • Display message - display rule's message on the status bar
  • Beep - Beep untill Stop Alarm button is selected
  • Send e-mail - Send out e-mail when the alarm is triggered. You need to define your SMTP server and To, From addresses