Logging Application Traffic

Problem

You want to log all traffic that belongs to a particular application.

Solution

Make use of the session keyword that was introduced in Recipe 2.n.

Description

If your application, like most do, uses a particular port on a particular machine, write a rule that detects this and use the session keyword to record it. For example, to record all traffic to and from a MySQL server running on TCP 3306 on a particular machine (192.168.0.8, for example), use the following rule:

alert tcp any any <> 192.168.0.8 3306 (msg: "MySQL"; session: all;)

 

See Also

Snort Users Manual

Recipe 2.27

Recognizing HTTP Traffic on Unusual Ports