Intrusion Detection Systems

learn more… | top users | synonyms (2)

2
votes
1answer
199 views

How to configure Suricata to not interfere with virtual machine

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
1
vote
1answer
68 views

Help with successful Internal intrusions

I'm requesting some help with a particular breach of access that we've experienced in our environment. the attacker is an internal employee who has made a few notes about the environment that I ...
1
vote
1answer
164 views

Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule)

I have the following rule: alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; ...
0
votes
1answer
60 views

Web-based intrusion detection integrating visibility into web app and database

Consider the problem of hardening an existing, database-backed web application, to detect attacks and stop them where possible. It seems like one plausible approach might be to build an intrusion ...
2
votes
0answers
251 views

Security Onion:snorby alerts shows all local nerwork source IP(public and private)

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
1
vote
0answers
169 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
1
vote
0answers
69 views

State transition Analysis Technique

As far as I have read and understood STAT is a concept used to design a platform independent IDS. My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
0
votes
0answers
112 views

Error configuring Snort

I am setting up snort on Windows 8 machine and having trouble with it. I am following the instructions mentioned here: http://www.snort.org/assets/151/Installing_Snort_2.8.6.1_on_Windows_7.pdf On ...
0
votes
0answers
64 views

Difference IDS/IPS layer 2 or 3

I understand that an IDS/IPS working on layer 2 has more insight into what is going on. But considering IDS/IPS evasions, why is a layer 2 device preferable as compared to a layer 3 device that is ...
-3
votes
0answers
51 views

iptables raw table

I'm trying to collect iptables common shield rules, here is my current list: echo "-Check for All flags enabled&Drop." iptables -I INPUT -p tcp --tcp-flags ALL ALL -j DROP echo ...