Writing Rules |
|
VisualSniffer can analyze network traffic for matches against a user defined rule set and give warning
messages based upon what it sees. VisualSniffer uses rules similar to Snort rules, which are explained at
www.snort.org. VisualSniffer rules consist of two logical
sections, the rule header and the rule options. The rule option section is enclosed in parenthesis and contains
one or more options, which could be messages or patterns on which parts of the packet should be inspected.
Rule options are separated from each other using the semicolon ; character.
tcp any any -> any 21 (msg:"FTP DELE overflow attempt";content:"DELE "; nocase; content:!"|0a|"; within:100;) | |
tcp any any -> any 21 (msg:"FTP CWD ~root attempt"; content:"CWD "; content:" ~root"; nocase;) |
The rule header contains protocol, source IP addresses, source port, direction, destination IP addresses, and the destination ports.
1. | Protocol: The first field in a rule is the protocol. This field could be one of the followings: tcp, udp, icmp, and ip. |
2. | IP addresses: In the second field and fifth field,
you should define the source and destination IP addresses. you can give a IP address or "any" for all IP
addresses. If you want VisualSniffer to check a range of addresses, you can use a block mask. A block mask of /24
indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address. For example,
216.104.129.100/24 would signify the block of addresses from 216.104.129.1 to 216.104.129.255. You may also
specify lists of IP addresses. An IP list is specified by enclosing a comma separated list of IP addresses
within square brackets. |
3. | Port Numbers: In the third field and sixth field, you should define the source and destination ports. you can give a number or "any" for all ports. If you want VisualSniffer to check a range of ports, you can use a range operator ':'. For example, 1:200 indicates port ranging from 1 to 200; :60 means all ports less than or equal to 60; 500: represents ports greater than or equal to 500. |
4. | Direction: There are two direction operators, -> and <>. The direction operator -> indicates the IP address and port numbers on the left side of the direction operator is from the source host, and the address and port information on the right side of the operator is the destination host. The bi-directional operator <> tells VisualSniffer to consider the address/port pairs in either the source or destination orientation. |
A rule option consists of keyword and parameter. option keyword is separated from its argument with a colon ':' character. VisualSniffer rules support the following options:
1. | msg - shows a message in the packet decoded view. It's parameter is a simple text string. For example, msg: "SYN packet". |
2. | ttl - test the IP header's TTL field value. This option keyword was intended for use in the detection of traceroute attempts. It's parameter is a number and preceded by one of the following operators: !, >, <, >=, and <=. These operators are optional. If there is no operator, the test will only be successful on an exact match. |
3. | tos - test the IP header's TOS field value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
4. | id - test the IP header's fragment ID field for a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
5. | ipoption - watch the IP option fields
for specific codes. Valid parameters to this option are:
|
6. | fragbits - test the fragmentation bits of the IP header. There are three bits that can be checked, the Reserved Bit (R), More Fragments (M) bit, and the Don't Fragment (D) bit. You can use '+' or '-' to indicate a bit is set or no. You can also test one or more bits. For example, R+M- means to match Reserved Bit on and More Fragments bit off; D- matches Don't Fragment bit is no set. |
7. | dsize - test the packet's payload size against a value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
8. | flags - test the TCP flags for certain
values. There are six bits that can be checked,
You can use '+' or '-' to indicate a bit is set or no. You can also test one or more bits. For example, F+A- means to match FIN Bit on and ACK bit off; P- matches PSH bit is no set. |
9. | seq - test the TCP sequence number field for a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
10. | ack - test the TCP acknowledgement field for a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
11. | itype - test the ICMP type field against a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
12. | icode - test the ICMP code field against a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
13. | icmp_id - test the ICMP ECHO ID field against a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
14. | icmp_seq - test the ICMP ECHO sequence number against a specific value. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
15. | content - search for a pattern in the packet's payload. The option data for the content keyword can contain mixed text and binary data. The binary data is generally enclosed within the pipe (|) character and represented as bytecode. Bytecode represents binary data as hexadecimal numbers. For example, content:"|90C8 C0FF FFFF|/bin/sh". Multiple content rules can be specified in one rule. This allows to match complex patterns. If the rule is preceded by a !, it matches all packets that do not contain this content. |
16. | offset - modifier for the content option, sets the offset to begin attempting a pattern match. It's parameter is a number. |
17. | depth - modifier for the content option, sets the maximum search depth for a pattern match attempt. It's parameter is a number. |
18. | nocase - match the preceding content string with case insensitivity. This option has no parameter. |
19. | ip_proto - IP header's protocol value. It's parameter is a number. |
20. | sameip - determines if source ip equals the destination ip. This option has no parameter. |
21. | distance - forcing relative pattern matching to skip space. It's parameter is a number. |
22. | within - forcing relative pattern matching to be within a count. It's parameter is a number. |
23. | tcpres - test the TCP reserved field. It's parameter is a number and optionally preceded by one of the following operators: !, >, <, >=, and <=. If there is no operator, the test will only be successful on an exact match. |
24. | symbol - shows a symbol in the packet list view. It's parameter is a simple text string. For example, symbol: "SYN". |
You can create an alarm with a rule. When a captured packet matched the rule, it will trigger the alarm.
1.
click on the Set Rules button or select Options -> Rules...
from the menu.
2.
In the Rule Edit dialog, select the rule that you want to set an alarm. button.
3.
Select the Set Alarm button
4.
In the "Alarm Setup" dialog, enter the following information: