Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm writing a strict snort rule parser and I would like to accommodate snort rules from popular plugins. The documentation specifies that any action/type is possible because they can be defined by plugins. However, I would like to have a list of known actions to lookup against in order to throw warnings to users.

Currently, I know of the following snort actions:

alert
log
pass
activate
dynamic
drop
sdrop
reject

Are there any other custom actions that you use or know of?

share|improve this question

3 Answers 3

up vote 2 down vote accepted
+100

Custom actions are defined by ruletype declarations in snort.conf; these custom actions can then be used in your rules. From the default snort.conf:

# You can optionally define new rule types and associate one or more output
# plugins specifically to that type.
#
# This example will create a type that will log to just tcpdump.
# ruletype suspicious
# {
#   type log
#   output log_tcpdump: suspicious.log
# }
#
# EXAMPLE RULE FOR SUSPICIOUS RULETYPE:
# suspicious tcp $HOME_NET any -> $HOME_NET 6667 (msg:"Internal IRC Server";)

Because ruletypes can be completely arbitrary, it makes more sense to parse the snort.conf file for any ruletypes defined first and then use that in your rule parser's action hash or whatever to match against.

share|improve this answer

This may be a good starting point. I don't believe these are the default.

http://cvs.snort.org/viewcvs.cgi/snort/rules/

share|improve this answer
    
Those rules are from snort.org and all have the actions listed above. –  Elijah Aug 2 '09 at 9:10

block and sblock were added in 2.9.0.5 (or thereabouts). See the manual for specifics. They're essentially mirrors for drop and sdrop.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.