LAND Attack 탐지 rule

Num 1

ubuntu

$ alert icmp ubuntu_ip any -> ubuntu_ip any (sid:1000001;)

kali

$ hping3 ubuntu_ip -a ubuntu_ip --icmp

ubuntu

$ snort -A console -q -u snort -g snort -c /etc/snort/snort.conf

Num 2

ubuntu

$ alert icmp ubuntu_ip any -> ubuntu_ip any (sameip; sid:1000001;)

kali

$ hping3 ubuntu_ip -a ubuntu_ip --icmp

ubuntu

$ snort -A console -q -u snort -g snort -c /etc/snort/snort.conf

Num 3

ubuntu

$ alert ip ubuntu_ip any -> ubuntu_ip any (sid:1000001;)

kali

$ hping3 ubuntu_ip -a ubuntu_ip --icmp

ubuntu

$ snort -A console -q -u snort -g snort -c /etc/snort/snort.conf