Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

0
votes
1answer
13 views

Questions on snort generating too many events and not sending to syslog

New to snort here. I downloaded snort (2.9.6.0 GRE Build 47) on my Ubuntu 14.04, also downloaded emergingthreat rules. I ran the following command root@myhp:~/pkgs/emergeThreats/snortRules# snort -...
3
votes
0answers
88 views

Extra p0f v3 fingerprints files?

p0f v3 is a passive operating system detector. The latest release is 3.08b, dating to November, 2014. Given the releases of Windows 10, multiple Linux, Firefox and Chrome versions since then, the ...
3
votes
0answers
98 views

Decrypt TLS from an IDS

So I am trying to figure out what the packet payload is off of a possible TLS HeartBleed alert from my IDS. I have read that Wireshark is able to do it with some certain keys, but isn't that in real ...
3
votes
0answers
537 views

Security Onion:snorby alerts shows all local nerwork source IP(public and private)

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
2
votes
0answers
69 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
2
votes
0answers
42 views

Priming an IDS/IPS for an impending attack

Is there a system which can put an IDS/IPS in "high alert" mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if ...
1
vote
0answers
52 views

Inconsistent duplicate TCP packets

How often does it happen that we benignly see a TCP packet that is retransmitted but has a different payload the second time? In other words, how often is it that we see a TCP packet with sequence ...
1
vote
0answers
66 views

Network configuration for Security Onion on VMWare ESX

I'm setting up an IDS using Security Onion on VMWare ESX. I have a VLAN from the (physical) switch which has the network SPAN port; this is feeding into the ESX virtual switch, and this port group is ...
1
vote
0answers
35 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
1
vote
0answers
11 views

Adding Windows 7 VM as a log source/forcing the IDS inline

I'm investigating ways to add my Windows 7 VM as a log source or even run that traffic through my IDS VM and then out to the internet but I'm not entirely sure how to approach it. Does anybody have ...
1
vote
0answers
59 views

problem blocking TCP scans by setting up honeyd in virtual environment

I am creating a virtual environment where I have created three virtual machines, CentOS as an Apache Webserver CentOs as an Attacker machine FreeBSD with Honeyd to setup Honeypot I have ...
1
vote
0answers
144 views

How to test OSSEC HIDS using a linux dataset containing raw system call traces?

I have been tasked to test effectiveness of OSSEC HIDS (by effectiveness I mean detection rate it achieves as well as false positives rate) when a dataset of raw system call traces are used. The ...
1
vote
0answers
414 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
1
vote
0answers
828 views

Difference IDS/IPS layer 2 or 3

I understand that an IDS/IPS working on layer 2 has more insight into what is going on. But considering IDS/IPS evasions, why is a layer 2 device preferable as compared to a layer 3 device that is ...
1
vote
0answers
645 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
1
vote
0answers
146 views

State transition Analysis Technique

As far as I have read and understood STAT is a concept used to design a platform independent IDS. My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
0
votes
0answers
26 views

Snort rules fo detecting meterpreter sessions

I am learning configuring snort in my setup consisting of an attacker(linux), a victim(android smartphone) and 1 detection system. So far, i have been able to log all the packets between the attacker ...
0
votes
0answers
13 views

VM Introspection on Public IaaS clouds

I came across this Security SE post and a few papers on VM Introspection [1] [2] [3] What prevents cloud providers like AWS from using techniques like these to observe EC2 instance activity? If they ...
0
votes
0answers
34 views

Process of auditd -s enable/disable persists for a long time

I have setup auditd on my system, with some basic rules from CIS Benchmark paper and the following auditd.conf file: log_file = /var/log/audit/audit.log log_format = RAW log_group = root ...
0
votes
0answers
27 views

Snort matching against single packets

For a specific task, I'd like to match snort rules against the first 1-2 packets of each flow in the network without waiting for the other subsequent flow packets. Can I do this with snort? If so, how?...
0
votes
0answers
169 views

Suricata IPS manual blocking/unblocking vs. snort and guardian

Does anyone have experience with using Suricata as an IPS? Im on Debian and I'd like to be able to manually block and unblock specific ip addresses (iptables). I've not used Suricata as I am currently ...
0
votes
0answers
118 views

Snort arpspoof preprocessor not giving alerts

I'm attempting to use Snort to detect a simple arpspoof attack on a test network I've set up. I have the following 4 ip addresses on this network. 192.168.1.1 Router 00:18:39:EC:F5:78 192.168.1.2 ...
0
votes
0answers
76 views

Snort rule to detect More Fragments fragbit not working

I have a Virtualbox setup with Snort running on a Windows 7 host and Kali Linux as the attacking machine, connected on an internal network. I'm investigating ways to get Snort to detect fragmentation ...
0
votes
0answers
86 views

Is EasyIDS obsolete?

I have found EasyIDS from Skynet Development recently but noticed that the latest change-log is from 2009. Does this mean it is obsolete and should not be used as it is not being kept up-to date?
0
votes
0answers
119 views

Switching from Snort rules to Emerging Threats. Is there a way to know which ET rule sid covers the same vulnerabilty as Snort rule sid?

Our company has been using the snort community rules and we have tuned our rule files over years to our specific needs. Now our company has decided to use Emerging Threats (ET) open rules. The ET ...
0
votes
0answers
415 views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 (msg:"...
0
votes
0answers
51 views

Possible to run snort without modifiers?

Is there anyway (e.g some command line argument) with which we can tell snort to run and perform detection but without caring for the rule modifiers if there are any ? e.g alert tcp any any -> ...