Format

    tag:<type>, <count>, <metric>[, direction];

type

 

• session - Log packets in the session that set off the rule

• host - Log packets from the host that caused the tag to activate (uses [direction] modifier)

count

 

• <integer> - Count is specified as a number of units. Units are specified in the $<$metric$>$ field.

metric

 

• packets - Tag the host/session for $<$count$>$ packets
• seconds - Tag the host/session for $<$count$>$ seconds
• bytes - Tag the host/session for $<$count$>$ bytes

direction

- only relevant if host type is used.

• src - Tag packets containing the source IP address of the packet that generated the initial event.

• dst - Tag packets containing the destination IP address of the packet that generated the initial event.

Note that neither subsequent alerts nor event filters will prevent a tagged packet from being logged. Subsequent tagged alerts will cause the limit to reset.

    alert tcp any any <> 10.1.1.1 any \
        (flowbits:isnotset,tagged; content:"foobar"; nocase; \
         flowbits:set,tagged; tag:host,600,seconds,src;)

Also note that if you have a tag option in a rule that uses a metric other than packets, a tagged_packet_limit will be used to limit the number of tagged packets regardless of whether the seconds or bytes count has been reached. The default tagged_packet_limit value is 256 and can be modified by using a config option in your snort.conf file (see Section 2.1.3 on how to use the tagged_packet_limit config option). You can disable this packet limit for a particular rule by adding a packets metric to your tag option and setting its count to 0 (This can be done on a global scale by setting the tagged_packet_limit option in snort.conf to 0). Doing this will ensure that packets are tagged for the full amount of seconds or bytes and will not be cut off by the tagged_packet_limit. (Note that the tagged_packet_limit was introduced to avoid DoS situations on high bandwidth sensors for tag rules with a high seconds or bytes counts.)

    alert tcp 10.1.1.4 any -> 10.1.1.1 any \
        (content:"TAGMYPACKETS"; tag:host,0,packets,600,seconds,src;)