@erasedhammer said in Snort Custom Rule not alerting on traffic:
So filtering on dsize greater than zero with a Syn flag should match any TCP Syn packet with something in the TCP payload.
But I believe your "content:" string is going to be checked and found not present, thus no alert.
The way I understand the content keyword is that it will expect to find that particular string in the packet payload, and if the entire string is not present in the payload then it will not alert.
Your rule is looking for the string "TCP SYN Packet Containing Data Payload Detected", but that exact string is not present in your rule. Instead, your test is loading the payload with the string "datadatadatadatadata".