1
.\" This file Copyright 2000 Luca Deri <deri@ntop.org>
8
.TH NTOP-RULES 8 "February 2000"
13
ntop allows users to specify rules to which traffic should comply. If this does not happen, ntop emit alerts according to the specified rules. Contrary to rules used with packet filtering tools and firewall toolkits, ntop rules do not specify explicit addresses/subnets but they are general and valid for each host whose traffic is monitored by ntop.
15
Comment lines start with '#'. Each rule has the following format "protocol rule-label rule-options".
18
It can be tcp, udp, or icmp.
21
It is a unique (among the specified rules) word that uniquely identifies the rule.
24
Options vary according to the specified protocols. Options order is very imporant. Supported options are:
27
This keyword is used to specify that the rule matches with shost/sport and dhost/dport arguments reverted a previous rule. For instance if a rule matched an ICMP echo and this rule is used to catch ICMP ECHO reply, then the revert keyword has to be used.
29
.It "shost/sport dhost/dport"
30
This is used to specify where the matching packet is originating/destinated. In case of ICMP packets only shost/dhost is used. Possible values host shost and dhost are: any (any host), broadcast (a broadcast address), multicast (a multicast address), gateway (a host that ntop has identified as gateway because it has been used by other hosts for routing packets), dns (a host that ntop has identified as a DNS because it has been used by other hosts for mapping addresses). Negatio (not) is pecified using '!' (for instance !gateway). Please note that '!any' is an invalid combination. As far sport and dport are concerned valid values are any (any port), !any (any port of the target host no matter whether the target port matches the port of the previous packet matching this rule), usedport (a port on which ntop has seen traffic before), !usedport (a port on which ntop has not seen traffic before).
33
TCP packets can have some flags set. The syntax used for flags is a string made of one (or more) of the following chars: F (FIN), P (PUSH), A (ACK), F (FIN), and R (RESET). For instance "flags AP" is a valid statement.
36
ICMP rules need to specify the ICMP packet type. Valid types are: ICMP_ECHOREPLY, ICMP_ECHO, ICMP_UNREACH, ICMP_REDIRECT, ICMP_ROUTERADVERT, ICMP_TIMXCEED, ICMP_PARAMPROB, ICMP_MASKREPLY, ICMP_MASKREQ, ICMP_INFO_REQUEST, ICMP_INFO_REPLY, ICMP_TIMESTAMP, ICMP_TIMESTAMPREPLY, ICMP_SOURCE_QUENCH.
38
.It "type packet/fragment"
39
This statement is used to restrict the match only to packets or fragments. If not specified, packet is assumed.
41
.It "pktsize/pktcount operator value"
42
This statement is used to further restrict the match. Either pktsize (the size of the current packet) or pktcount (the number of packets that matched this rule so far) can be specified. The operator can be '<', '>', or '=', whereas value is an integer.
45
This statement is used to specify the amount of time during which the revious match 'pktcount' should occour. In other words, it specifies the amount of time in which ntop should receive the above specified number of packets matching this rule. For instance 'pktcount > 30 unit 10' means that ntop must capture at least 30 packets that match this rule within 10 seconds since the first match.
48
Valid actions executed when the packet matches the rule, are: alarm (send out an alarm), and mark (mark this packet for tuture use).
50
.It "cleans rule-name"
51
The cleans keyword is used with mark (see above) for cleaning out packets marked using the rule rule-name. A packet cleans exactly a marked packet (if any). In case a packet has to clean all the marked packets using rule-name, the the 'all' keywords can be specified after the rule-name.
54
When a rule is matched, it might be necessary to specify that the rule is disable for the current shost/sport/dhost/dport combination for the specified amount of time. This feature is usefult to limit the number of matches within a specified amount of time.
58
.It "tcp syn any/any any/any flags S action mark expires 60"
59
Mark all the sync packets (any/any means any source port to any destination. If within 60 seconds they have not been cleared an event is generated
61
.It "tcp ack revert any/any any/any flags A clears syn all"
62
The event below clears the "syn" event (see above) all (i.e. if several "syn" events are waiting to be cleared, it then clears all of them). The revert keywork means that the "ack" event clears the "syn" event if the shost/sport and dhost/dport are reverted (for instance if host A/sport X sends the "syn" event to host B/dport Y, then the "ack" event must be sent from host host B/dport Y to host A/sport X).
64
.It "icmp route-advertisement ICMP_ROUTERADVERT !gateway/any action alarm"
65
If an host receives an ICMP Route Redirect from a host that's not a gateway (or one of the gateways used so far) then an alarm is generated.
67
.It "udp new-port-open any/any any/!usedport action mark"
68
Notify when a host received udp traffic on a port on which ntop has observed no traffic before
70
.It "udp udp-short-fragment any/any any/any type fragment pktsize < 256 action alarm"
71
.It "tcp tcp-short-fragment any/any any/any type fragment pktsize < 256 action alarm"
72
Issue an alarm for fragments whose size is less that 256 bytes
74
.It "icmp ping-flood ICMP_ECHO any/any pktcount > 30 unit 10 action alarm rearm 90"
75
Send an alarm if an host receives more than 30 ICMP echo packets within 10 seconds. If the rule is fired, then it will be re-enabled not before 90 seconds (this avoids ntop to send too many alarms)
77
.It "tcp root-ftp any/ftp any/any contains "230 User root logged in." action alarm"
78
Send an alarm when a user connects to an FTP server as root
80
.It "tcp stealth-scan any/!any any/!any flags S pktcount > 3 unit 20 action alarm"
81
.It "tcp session-reset any/!any any/!any flags R pktcount > 30 unit 20 action alarm rearm 10"
82
If a host receives more than 10 packets with the syn flag set within 20 seconds, an alarm is generated. Note that "!any" means any port of the target host no matter whether the target port matches the port of the previous packet that also had the syn flag set
84
.It "tcp tcp-nmap-scan any/!any any/!any flags SF action alarm"
85
This rule is used to identify nmap scans.
90
is based on the libpcap library that can be found
91
at ftp://ftp.ee.lbl.gov/libpcap.tar.Z. The Win32 version makes use of
92
libpcap for Win32 that can be downloaded from http://www.ntop.org/libpcap.html).
101
Please send bug reports to the ntop mailing list <ntop@ntop.org>. ntop's author is Luca Deri <deri@ntop.org>.
b'\\ No newline at end of file'
added
removed
ntop/ntop-rules.8
