how can i block a string in a packet?
-
Hi,
I run some game servers and from time to time they get hit with dos/ddos based attacks but we are lately seeing the attack packets end in the same text string, it would be nice to filter based on the strings they are using.Is there a guide or something I can use to help setup a rule that could block based on the content ?
-
@madmaxpr
The first package that comes to mind is Suricata/Snort.
You will need to write your own custom rules of which there are many examples on the Internet that instruct how to do so.
The packets will need to be unencrypted, in other words, the Suricata engine will need to see the packet in clear text and analyze the payload in order to determine if it matches your custom signature.
If the packets arrive wrapped in TLS....you're out of luck. -
@michmoor Thanks, we are familiar with snort and have that in place already but wanted more direction to some examples online using snort and implementing it.
The packets we see are luckily unencrypted :)
-
A quick Google search with this term: "writing snort rules examples" yields a ton of results. Here are a few of them--
https://www.sapphire.net/security/snort-rules-examples/
https://cyvatar.ai/write-configure-snort-rules/
https://www.crowdstrike.com/cybersecurity-101/threat-intelligence/snort-rules/
