Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm writing a strict snort rule parser and I would like to accommodate snort rules from popular plugins. The documentation specifies that any action/type is possible because they can be defined by plugins. However, I would like to have a list of known actions to lookup against in order to throw warnings to users.

Currently, I know of the following snort actions:


Are there any other custom actions that you use or know of?

share|improve this question
up vote 2 down vote accepted

Custom actions are defined by ruletype declarations in snort.conf; these custom actions can then be used in your rules. From the default snort.conf:

# You can optionally define new rule types and associate one or more output
# plugins specifically to that type.
# This example will create a type that will log to just tcpdump.
# ruletype suspicious
# {
#   type log
#   output log_tcpdump: suspicious.log
# }
# suspicious tcp $HOME_NET any -> $HOME_NET 6667 (msg:"Internal IRC Server";)

Because ruletypes can be completely arbitrary, it makes more sense to parse the snort.conf file for any ruletypes defined first and then use that in your rule parser's action hash or whatever to match against.

share|improve this answer

This may be a good starting point. I don't believe these are the default.

share|improve this answer
Those rules are from and all have the actions listed above. – Elijah Aug 2 '09 at 9:10

block and sblock were added in (or thereabouts). See the manual for specifics. They're essentially mirrors for drop and sdrop.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.