[Snort-sigs] Detecting Connections

From: Faiz Ahmad Shuja <faizshuja(at)yahoo.it>
Date: Thu May 29 2003 - 04:29:25 EDT

Does anybody have idea about detecting multiple connections from a single IP?. I want to detect multiple established connections from a single IP to mail server [port 25]. Somtimes a single IP have taken up all the connection slots. Is there anyway to set a threshold?. If I am getting multiple connections from a single host to any service and it reaches a specific count, I get the alert?.

Please advise.

Thanks!

Regards,
Faiz

---

Do you Yahoo!?
Free online calendar with sync to Outlook(TM).

---

This SF.net email is sponsored by: eBay
Get office equipment for less on eBay!
http://adfarm.mediaplex.com/ad/ck/711-11697-6916-5

---

Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs Received on Thu May 29 05:25:37 2003