Take the 2-minute tour ×

The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Snort looks at network activity, so it would have to be something that the client-side app sends over the network. At that point, you would need to look at the messages that the client sends out, which could be grabbed by Snort. Pre-defined? No, there are too many client-side apps to catch them all.

Snort rule template:

alert tcp any any -> any 80 (msg: "Client Unhappy";content:"Client unhappy text";nocase;)

This rule is pretty basic, but it's the place to start. To reduce false positives, you would also want to look at the ports the client and server use to communicate messages and refine your rules to look there.

Here is a SANS guide on how to look for certain text, and refinements.

share|improve this answer
Thanks, I know I could define a rule for just about anything. I just wasn't sure if a rule existed for 'client side app alert' –  hbdgaf Mar 22 '12 at 16:59
I don't think there could be. There is no standard for error messages above layer 4, so you would have to write your own and grep through the data. The definition of 'fishy' would be application-dependent and not common between applications. –  schroeder Mar 22 '12 at 18:39
Thanks I think you nailed it more in the question with 'No, there are too many client-side apps to catch them all'. And no there is no standard rule for appname field thinks eventid Y is causing problem level z. –  hbdgaf Mar 22 '12 at 19:56

Your Answer


