Battle.net Snort Signatures

[iago]

Last night, I wrote a set of Snort rules to detect problems with my Battle.net connection.  The rules can be found here:
http://www.javaop.com/~iago/battle.net.rules

Here is a screenshot of them working, with Base:
http://www.javaop.com/~iago/snort-battle.net.png

It should be included in the Bleeding Snort ruleset, under the Policy rules. 

[rabbit]

You lost me at "I wrote a set of Snort rules"

[Newby]

Then don't post? :p

Seems cool, I suppose.

[01Linux]

Reminds me of QwertyMonster from vL forums

[Newby]

Nope, it would have been "Lol haha :P" instead.

Man, I'm clever.

[iago]

Snort is a program that detects network attacks based on signatures.  I posted the link to Snort's site so people could figure that out themselves instead of looking stupid :P

I wrote some signatures for it that, instead of detecting attacks, detects Battle.net problems.  If you look at the screenshot, you'll see that it sees failed logins and stuff.

And incidentally, Bleeding-Snort might be adding another rule set, specifically for games.  If they do, Battle.net stuff will go in there..  We'll see!

[rabbit]

See, I didn't see a short, simple description like that on the Snort page.  That's why I asked.  The FAQ went right from pronouncing names into IDS messages or something.

[RoMi]

Ron has sent us a nice collection of game server sigs for battlenet
servers. Yup, people still play starcraft (myself included) :)

To accomodate these we've started a games ruleset. There are enough of
these sigs, and the possibility of others that it's worth it.

So if you're interested in running these sigs be sure to add the
following to snort.conf:

Go iago~!

[iago]

Ron has sent us a nice collection of game server sigs for battlenet
servers. Yup, people still play starcraft (myself included) :)

To accomodate these we've started a games ruleset. There are enough of
these sigs, and the possibility of others that it's worth it.

So if you're interested in running these sigs be sure to add the
following to snort.conf:

Go iago~!

Just to make it stand out more: http://lists.bleedingsnort.com/pipermail/bleeding-sigs/2005-July/000675.html

I've been talking to the admin all day, actually.  He's a great guy.

[Krazed]

Congradulations, quite an accomplishment.