Forest Global Training Partners

Cyber Risks · Cisco Talos

Tips for Writing Good Rules from a n00b

Summary: A Cisco Talos VRT author two months into the job explains how Snort's detection engine uses a two-level labeling system, with a protocol-port pair as the top label and a content match as the second, chosen by the first and longest non-negative content match unless the fast_pattern modifier overrides it. The piece notes that rules without any content match land in an unlabeled bin that is always evaluated, and that Snort checks cheaper options like dsize, flow and flowbits before source and destination addresses and ports.

What you should know: Every rule without a content match sits in the unlabeled bin and gets evaluated against all traffic, so a handful of loosely written rules can quietly add load to every packet your sensors inspect.

Read the original at Cisco Talos ↗

Topics
Malware
Related