I am in need of help in writing my own signature to control dictionary attacks on a proprietary application on one of our main frame applications.
I was looking at writing a rule using the flood net engine. Does anyone have more information on what the different variables for this engine are? If I set the rate for 3 and the peaks and gaps to 0, will this block the 4th attempt in a second?
I also need to try to lock this signature down. I could not allow it to block every 4th connection attempt from one IP address. How can you lock this signature down to a specific port and IP address? Does it need to be written into a meta engine signature?
details matter, but that seems like a less than optimal choice for the engine. Load up the signature policy and do a select by "sig name". Enter "failure" in the sig name box and click find. You might try modeling a signature after the one of these (6256-0 for example). Is there anything in the response that you can look for?