Writing Snort Rules
How To write Snort rules and keep your sanity
Current as of version 1.3.1.2
By Martin Roesch
Contents


The Basics
Snort uses a simple, lightweight rules description language that is flexible and quite powerful.  There are a number of simple guidelines to remember when developing Snort rules.

The first is that Snort rules must be completely contained on a single line, the Snort rule parser doesn't know how to handle rules on multiple lines.

Snort rules are divided into two logical sections, the rule header and the rule options.  The rule header contains the rule's action, protocol, source and destination IP addresses and netmasks, and the source and destination ports information.  The rule option section contains alert messages and information on which parts of the packet should be inspected to determine if the rule action should be taken.

Here is an example rule:

alert tcp any any -> 192.168.1.0/24 111 (content:"|00 01 86 a5|"; msg: "mountd access";)
Figure 1 - Sample Snort Rule

The text up to the first parenthesis is the rule header and the section enclosed in parenthesis is the rule options.  The words before the colons in the rule options section are called option keywords.  Note that the rule options section is not specifically required by any rule, they are just used for the sake of making tighter definitions of packets to collect or alert on (or drop, for that matter).  All of the elements in that make up a rule must be true for the indicated rule action to be taken.  When taken together, the elements can be considered to form a logical AND statement.  At the same time, the various rules in a Snort rules library file can be considered to form a large logical OR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.

IP Addresses:

The next portion of the rule header deals with the IP address and port information for a given rule.  The keyword "any" may be used to define any address.  Snort does not have a mechanism to provide host name lookup for the IP address fields in the rules file.  The addresses are formed by a straight numeric IP address and a CIDR block.  The CIDR block indicates the netmask that should be applied to the rule's address and any incoming packets that are tested against the rule.  A CIDR block mask of /24 indicates a Class C network, /16 a Class B network, and /32 indicates a specific machine address.  For example, the address/CIDR combination 192.168.1.0/24 would signify the block of addresses fmOR statement.  Let's begin by talking about the rule header section.


Rule Headers
Rule Actions:

The rule header contains the information that defines the "who, where, and what" of a packet, as well as what to do in the event that a packet with all the attributes indicated in the rule should show up.  The first item in a rule is the rule action.  The rule action tells Snort what to do when it finds a packet that matches the rule criteria.  There are three available actions in Snort, alert, log, and pass.

Protocols:

The next field in a rule is the protocol.  There are three IP protocols that Snort currently analyzes for suspicious behavior, tcp, udp, and icmp.  In the future there may be more, such as ARP, IGRP, GRE, OSPF, RIP, IPX, etc.