-
December 7th, 2003, 01:41 AM
#1
Senior Member
3D linkx in snort
what are 3D rules set links in snort?? and what do they do?? i never understood that.
-
December 9th, 2003, 03:12 PM
#2
I've just upgraded my snort to version 2.0.5 and I have no idea of what rules you are talking about. Can you be more specific?
Oliver's Law:
Experience is something you don't get until just after you need it.
-
December 9th, 2003, 09:38 PM
#3
Senior Member
this is from http://www.snort.org/docs/lisapaper.txt
Snort - Lightweight Intrusion Detection for Networks
Martin Roesch
roesch@clark.net
The detection engine
Snort maintains its detection rules in a two dimensional linked list of
what are termed Chain Headers and Chain Options. These are lists of rules that
have been condensed down to a list of common attributes in the Chain Headers,
with the detection modifier options contained in the Chain Options. For
example, if forty five CGI-BIN probe detection rules are specified in a given
Snort detection library file, they generally all share common source and
destination IP addresses and ports. To speed the detection processing, these
commonalities are condensed into a single Chain Header and then individual
detection signatures are kept in Chain Option structures.
Figure 3 - Rule Chain logical structure
-------------------------------------------------------------------------------
------------------------ ------------------------ -----
| Chain Header | | Chain Header | | Chai
| | | | |
| Source IP Address | | Source IP Address | | Sour
| Destination IP Address |--------->| Destination IP Address |--------->| Dest
| Source Port | | Source Port | | Sour
| Destination Port | | Destination Port | | Dest
| | | | |
------------------------ ------------------------ -----
| |
| |
| |
\|/ \|/
-----------V--------- -----------V---------
| Chain Option | | Chain Option |
| | | |
| Content |
| TCP Flags |
| ICMP Codes/types |
| Payload Size |
| etc. |
| |
---------------------
|
|
|
\|/
-----------V---------
| Chain Option |
| |
| Content |
| TCP Flags |
| ICMP Codes/types |
| Payload Size |
| etc. |
| |
---------------------
|
|
-------------------------------------------------------------------------------
These rule chains are searched recursively for each packet in both
directions. The detection engine checks only those chain options which have
been set by the rules parser at run-time. The first rule that matches a
decoded packet in the detection engine triggers the action specified in the
rule definition and returns.
---------------------------------------------------------------------------------------------------------------------------
**********************************************************************************
any one know what this is talking about, i could not understand it.
-
December 9th, 2003, 09:46 PM
#4
where does the tern "d3 ruleset link" come in context?
-
December 9th, 2003, 09:54 PM
#5
qod: I'd kinda forget about that. The paper is about 3 years old and refers back to version 1.5 or so. We are at 2.0.5 right now and the detection engine no longer chains similar rules in the way that it did back then.
Don\'t SYN us.... We\'ll SYN you.....
\"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
-
December 9th, 2003, 09:56 PM
#6
Senior Member
no but i was reading the book snort 2 : intrusion detection and it still talks about 3 Dimentional links, that i still do not understand how they work or why they are needed??
-
December 9th, 2003, 10:09 PM
#7
what page.... there's nothing in the index and I need a reminder of what it is talking about.
Don\'t SYN us.... We\'ll SYN you.....
\"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
-
December 9th, 2003, 10:36 PM
#8
Yes, I have the book too and I also searched snort.org so I am confused.
-
December 9th, 2003, 10:37 PM
#9
ah 114-115 118-119
Page 118 Header "What is a 3d linked list"
It's just a way to look at how (or map) how the rules are processed?
Still consuming.
-
December 9th, 2003, 10:45 PM
#10
Ok..... All Snort is doing is creating an array of sorts out of the rules themselves to aid in speeding up rule matches. Frankly I can't think of a better way of explaining it than the book does. Look at the diagram of the tree as you read the text on the pages mentioned by Roadclosed and it should become crystal clear.....
Don\'t SYN us.... We\'ll SYN you.....
\"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|