Welcome to the next module for this course,
where we'll begin refining our rules with a few different options to detect
specific payloads or specific packet information and behavior.
Let's look at the overview and see what we'll cover in this module.
First up,
we're going to go over payload detection using content and its
associated options. Content allows Snort to inspect the payload
of each packet to detect specific strings and take the specified
action if they're detected.
This allows us to flag specific traffic instead of all
traffic destined for a particular port.
After exploring content, we'll discuss a few non‑payload detection options.
These allow Snort to base these actions on certain packet flags,
fragmentation, time to live, and the overall packet flow.
After discussing these two options, we'll move on
to post‑detection rule options, which control packet processing,
tagging, and logging after the rule actions are taken.
Each of these categories will include an example rule, a demo where
we'll continue configuring our Snort server, and we'll test each of
these rules with the target traffic.
If you're ready to get started, we'll begin with payload detection using content.