Is it even possible to specify into a snort rule the duration of a connection?
For example: in this format Hour, Minute, Second
H, M, S = 0, 2, 1
If a connection that has the duration of 2 minutes and 1 second, then alert.
Or in this sense:
If a connection is longer than 10 seconds, then alert.
How do we implement the idea?