<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hello Cooper,<div><br></div><div>thanks for your response.</div><div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div style="font-family: Arial; orphans: 2; widows: 2; "><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Arial; ">but if i adjust the threshold value it also highers the period in which the counter is increased? </div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Arial; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Arial; ">Simply spoken, isn't there a way to create a rule that triggers if threshold count 10 in 10 seconds and then drop it for 60 seconds?</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Arial; "><br></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Arial; ">Regards</div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; font: normal normal normal 12px/normal Arial; ">Michael</div></div></div></span></div></span></div></span></span>
</div>
<br><div><div>Am 22.08.2014 um 19:54 schrieb Cooper F. Nelson <<a href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a>>:</div><br class="Apple-interchange-newline"><blockquote type="cite"><fieldset style="padding-top:10px; border:0px; border: 3px solid #CCC; padding-left: 20px;"><legend style="font-weight:bold">Signierter PGP Teil</legend><div style="padding-left:3px;">You are telling suricata to only drop traffic for 10 seconds via the<br>threshold rule.<span class="Apple-converted-space"> </span> You probably shouldn't use thresholding for 'drop'<br>rules unless you are trying to drop floods/DOS or attempting to do some<br>kind of rate-shaping.<br><br>If you really want to drop all port 80 traffic try this rule:<br><br>> drop tcp any any -> any 80 (msg:"Local DROP Tcp port 80"; flow:from_client; sid:1;)<br><br>-Coop<br><br>On 8/22/2014 10:43 AM, First Root | Michael wrote:<br>> Hello Cooper,<br>><br>> thanks for your response.<br>> it is not the case that i simply want to drop specific traffic, but this<br>> was the easiest way to show what my problem is ;).<br>><br>> Is there any way to define how long the drop is valid as i asked in my<br>> last email?<br>><br>> Regards<br>> Michael<br>><br><br>--<br>Cooper Nelson<br>Network Security Analyst<br>UCSD ACT Security Team<br><a href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042</div></fieldset><br></blockquote></div><br></div></body></html>