Chapter 14. Snort Rules—Part II
The previous chapter provided an introduction to Snort, in general, and Snort rules. As you will recall, a Snort rule is composed of a rule header, which was examined in detail in the previous chapter, and a rule option, which will be covered thoroughly in this chapter.
The rule header supplies the action that will be applied if the rule is triggered. It details the source and destination IP addresses and ports, the protocol, and the direction of the traffic flow. The rule header can be used alone to form a rule, but it is usually followed by a rule option to provide more detail about the packet attributes. Ironically, ...
Get Network Intrusion Detection, Third Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
