Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to snort rules and need a rule that will alert any email from a specific user.. For example:

alert tcp any any -> any 25 (msg:"Target Email Detected"; content:""; fast_pattern:only; nocase; classtype: Target Email Detected ;sid:12345 ;)

This rule as of now will sniff it if it is in the content, but mail from the email above is not alerted.

share|improve this question

Your rule looks good for the most part. I believe the problem has to do with your sid mapping / classtype. If you define a new classtype as you have done there are additional configuration options that need to be set - in this case it is much easier to recycle something existing. I would suggest using a classtype of policy-violation.

RE: Comment The content field searches the entire body of the packet it sees. It shouldn't be a PCRE issue. You might want to look at assembling the stream. It might be that the string you are searching for is being broken between packets. Try firing up Wireshark and capturing the exact packets you want.

share|improve this answer
I created the custom classtype and it works ok, I feel its something with it not capturing mail headers right or something, would a pcre be needed? – ThatGuy Oct 18 '11 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .