The dsize Keyword Rule Options

98 Chapter 3 • Working with Snort Rules

3.6.10 The icmp_id Keyword

The icmp_id option is used to detect a particular ID used with ICMP packet. Refer to Appendix C for ICMP header information. The general format for using this key- word is as follows: icmp_id: ICMP_id_number An ICMP identified field is found in ICMP ECHO REQUEST and ICMP ECHO REPLY messages as discussed in RFC 792. This field is used to match ECHO REQUEST and ECHO REPLY messages. Usually when you use the ping command, both of these types of ICMP packets are exchanged between sending and receiving hosts. The sending host sends ECHO REQUEST packets and the destination host replies with ECHO REPLY-type ICMP packets. This field is useful for discovering which packet is the reply to a particular request. The following rule checks if the ICMP ID field in the ICMP header is equal to 100. It generates an alert if this criterion is met. alert icmp any any - any any icmp_id: 100; \ msg: ICMP ID=100;

3.6.11 The icmp_seq Keyword

The icmp_seq option is similar to the icmp_id keyword The general format for using this keyword is as follows: icmp_seq: ICMP_seq_number The sequence number is also a field in the ICMP header and is also useful in matching ICMP ECHO REQUEST and ECHO REPLY matches as mentioned in RFC 792. The keyword helps to find a particular sequence number. However, the practical use of this keyword is very limited. The following rule checks a sequence number of 100 and generates an alert: alert icmp any any - any any icmp_seq: 100; \ msg: ICMP Sequence=100;

3.6.12 The itype Keyword

The ICMP header comes after the IP header and contains a type field. Appendix C explains the IP header and the different codes that are used in the type field. A detailed discussion is found in RFC 792 at http:www.rfc-editor.orgrfcrfc792.txt. The itype keyword is used to detect attacks that use the type field in the ICMP packet header. The argument to this field is a number and the general format is as follows: itype: ICMP_type_number Rule Options 99 The type field in the ICMP header of a data packet is used to determine the type of the ICMP packet. Table 3-3 lists different ICMP types and values of the type field in the ICMP header. For example, if you want to generate an alert for each source quench message, use the following rule: alert icmp any any - any any itype: 4; \ msg: ICMP Source Quench Message received; The ICMP code field is used to further classify ICMP packets.

3.6.13 The icode Keyword

In ICMP packets, the ICMP header comes after the IP header. It contains a code field, as shown in Appendix C and RFC 792 at http:www.rfc-editor.orgrfcrfc792.txt. The icode keyword is used to detect the code field in the ICMP packet header. The argu- ment to this field is a number and the general format is as follows: icode: ICMP_codee_number Table 3-3 ICMP type filed values Value Type of ICMP Packet Echo reply 3 Destination unreachable 4 Source quench 5 Redirect 8 Echo request 11 Time exceed 12 Parameter problem 13 Timestamp request 14 Timestamp reply 15 Information request 16 Information reply