6
votes
1answer
1k views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
1
vote
1answer
225 views

SNMP trap by legitimate program?

Is there any way to tell if this SNMP trap is something created by a legitimate program? Update: Hex Dump 0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
1
vote
2answers
3k views

Snort false positive?

I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off: GPL SHELLCODE x86 inc ebx NOOP The payload is as ...
4
votes
2answers
974 views

How effective is an IDS at catching targeted attacks

I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies. I was ...
1
vote
1answer
482 views

types of intrusions on host [closed]

I am implementing an IDS and just want to know that what are the possibilities with which the intrusion can occur.I am just doing a literature survey over the atacks possible so I want to know that ...
4
votes
1answer
301 views

Attacks against HIDS software running on the same machine

I am interested in the attacks that could be used to compromise or disable HIDS software such as Tripwire or Samhain. I understand that ideally checks should be run periodically and the database ...
6
votes
4answers
625 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
22
votes
8answers
9k views

Can I detect web app attacks by viewing my Apache log file?

I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?