Creating your first Snort rule

I’ve talked about understading the basics of a Snort rule before, now i’m going to create my first rule and add it to Snort.

Before making the rule, i started thinking about what i want and why i want it.

Short scenario – you are a copyright freak and you want to know when somebody on your network (maybe a school network) is trying to download something by accessing The Pirate Bay.

Based on the short scenario i want my rule to send an alert (generate an event) whenever somebody is accessing The Pirate Bay website or a group of related websites. This is definately not the best way to stop people from downloading stuff on your network, but it’s just a simple scenario that will help me create my first rule.

I fired up Wireshark to see how that packet would so that i know what options i can set for my rule. I used my IP and the HTTP protocol as filters so i’ll spot the packet faster.

wireshark

As we can see, the client (me) is sending a GET request to the host named “thepiratebay.pe” , having the following full request uri –  http://thepiratebay.pe/

Rule pseudocode :

If somebody from our network ($HOME_NW) is sending a GET request to the piratebay website, generate an event.

Rule code:

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:”Accessing forbidden torrent websites”; flow:to_server; content:”thepiratebay.pe”; nocase; reference:url,truica-victor.com; classtype:web-access-on-forbidden-addresses; sid:1000005; rev:0; )

  • nocase specifies that it’s not case sensitive

How to add a rule or a set of rules to Snort

You can either create a new rules file and add it in the configuration file, or you can add new rules to the local.rules file.

snort rule adding

If you want to add a new ruleset file to Snorts configuration just modify snort.conf and add an “include line”.

nano /etc/snort/snort.conf

include /path/to/rule/file
include rules/personal.rules
After each ruleset update, or rule modification Snort has to be restarted so that the changes will take place.
service snort restart
If Snort is unable to restart, then you most likely have a problem with your rule. In my case, it was an unknown classtype. Make sure your rules are nice and tidy or else Snort won’t start up again.
snort fatal error
Rule generation GUI (for Windows)
I found a nice windows app that is basically a GUI for creating your own rules.
Download link – here
Video tutorial from its creator – here
Print Friendly, PDF & Email