Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

learn more… | top users | synonyms

0
votes
1answer
27 views

Windows SQL Server Intrusion Detection [on hold]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
1
vote
0answers
23 views

How use snort with local.rules in offline mode?

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used. How can I show only the result ...
2
votes
1answer
28 views

SNORT sfportscan alert format

How can I modify the output alert from sfportscan ? Ex : output alert_csv: /var/log/snort/portscan.log timestamp,src,dst,dstport,msg OBS: I can set output for default alert file with this method ?
2
votes
1answer
28 views

What does the http_uri content modifier do is SNORT

I am very confused about exactly what http_uri does. Can someone explain this to me w.r.t NORMALIZED and UNNORMALIZED uri fields?
0
votes
2answers
72 views

How to make sense of, and act on, Snort Rules?

I am a relatively new Snort user with years of sys admin experience. I feel that I must be missing something, because I find Snort rules to be completely undocumented and incomprehensible. Because of ...
0
votes
1answer
75 views

Snort - Rule: Alert all php requests

I am trying to understand writing rules for snort. Further goal is detection of sql injections like here. I've read the documentation of snort rules and created this rule: alert tcp any any -> ...
0
votes
0answers
37 views

Snort rule does not work when combining “content” fields

I'm trying to write a snort rule which outputs an alert whenever a web server returns an HTML document containing a specific string. I've come up with the following rule: alert tcp any any -> any ...
3
votes
1answer
157 views

How to detect changing IP address and user agent on a HTTP session?

I have some HTTP logs where I see the hacker changing his IP every request, and occasionally changing his useragent. Is there a way to detect this automatically? Perhaps a snort rule? or any other ...
0
votes
1answer
88 views

Snort: Arpspoof preprocessor events not showing up in BASE UI

I have followed this guide to install Snort, using Barnyard2, BASE, IIS, and MySql. My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted ...
2
votes
0answers
125 views

Snort alerts analysis (web interface) [closed]

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
1
vote
1answer
89 views

Question on SNORT Rule

I am new to SNORT and can not figure out what the following rule means: alert tcp $EXTERNAL_NET any-> $HOME_NET any (msg:"SCAN FIN"; flags: F; reference:arachnids,27;
-1
votes
1answer
139 views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
1
vote
1answer
91 views

Snort report - 1000+ alerts in 1 minute from port 5060

I woke up this morning and could see over 1000+ of these alerts. They came in the time space 23:34 - 23:35. Can anybody tell me what that was about and should I be worried for an eventual DDoS ...
5
votes
1answer
152 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
0
votes
0answers
180 views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 ...
2
votes
1answer
321 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
1
vote
0answers
110 views

Snort rule for outgoing attacks [closed]

I have a pcap file captured from a user PC. I need to analyze whether it has initialized a DOS attack to any server. alert tcp any any -> any 8080 (msg:"DOS flood denial of service attempt"; ...
0
votes
1answer
607 views

How to run a snort rule over pcap file

I have a pcap file, and what I wanted to know is how can I apply the Snortrule below which I've already written within the rules folder in my log folder: alert icmp any any -> any any (msg:"TCP ...
0
votes
0answers
62 views

What is a Packet Identifier (pid) used for?

I'm trying to analyze a pcap file using snort using the following command: snort -r file.pcap I got the output which had n number of packets and at the top i had this Packet Identifier pid=14782. ...
1
vote
0answers
428 views

How can I find threats/attacks from a PCAP - Wireshark, Snort [closed]

I have a pcap file and I am trying to analyze it using Snort and Wireshark. When I tried the command, which I had showed below, in Ubuntu I was provided with various output such as the date, time, ...
1
vote
1answer
88 views

What could this set of IDS alerts be (DDNS deaftone.com darktech.org chatnook.com, …)?

Below is a screeny of my Squert GUI showing the Snort events. Notice they all happen at the same exact time. I cannot figure out what the source of it could be. Any ideas? Edit: It looks like the ...
0
votes
1answer
165 views

Using OpenAppID without Snort [closed]

Cisco Security introduced open source application detection and control mechanism which called "OpenAppID". Which can be checked in the link Lets say I have a sniffer application for myself; if I ...
2
votes
1answer
605 views

Snort IDS for Amazon deployment

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt ...
1
vote
0answers
58 views

Snort only detect local issues [closed]

I have installed two physical machines with KVM virtualization using Red Hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 In h2 the virtual machines w2 , db1 and ids. ...
0
votes
0answers
45 views

Possible to run snort without modifiers?

Is there anyway (e.g some command line argument) with which we can tell snort to run and perform detection but without caring for the rule modifiers if there are any ? e.g alert tcp any any -> ...
1
vote
2answers
50 views

Separate normal traffic [closed]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...
2
votes
1answer
54 views

I want to filter Snort rules by date written [closed]

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
0
votes
1answer
100 views

Where does Snort log the messages when using a pcap file?

When you're using Snort for real-time monitoring the messages are logged to /var/log/snort/alerts. However, when you load a pcap file, where do you see if any packet triggered a rule? Because they ...
0
votes
1answer
197 views

Snort Rule Comparison

As far as I read, Emerging threats and VRT Snort rules are available freely, and also Pro (fee based). Is there any comparision, or anything to suggest choose one over another? What are the benefits ...
4
votes
2answers
1k views

Can installing Snort make me vulnerable?

I am using Ubuntu and am wondering if installing Snort on my host can make me more vulnerable?
0
votes
3answers
265 views

Is there any hardware solution for IDS? [closed]

Are there any products that let you see and set IDS [Intrusion detection system] on router or any another hardware that is connected to the router? All the ones I have found of them are Operating ...
0
votes
1answer
269 views

How can I test a DoS attack against snort?

I need to set up an scenario where an attacker DoS attacks port 80 of an server while snort and others users try to connect to port 80 at the same time. Something like this: 1000 connections to port ...
0
votes
1answer
86 views

What does this Snort rule do? [closed]

Rule-4: alert udp $EXTERNAL_NET any -> $HOME_NET 3333 (msg:"ET EXPLOIT Wireshark ENTTEC DMX Data Processing Code Execution Attempt 1"; content:"|45 53 44 44|"; depth:4; content:"|04|"; ...
0
votes
1answer
161 views

SNORT alert for Trufflehunter SFVRT 3:29312:1

I am seeing this Snort alert show up multiple times a day, but my Google-foo is failing me, as I can not find any information about this alert on the internet. Can anyone point me in the direction ...
0
votes
2answers
530 views

honeyd is still a good alternative?

I've been investigating to deploy a honeypot for research purpose, Honeyd seems like the most popular and adequate option to my needs, but it seems too old, the last version of this software was ...
0
votes
2answers
544 views

Can't understand SNORT rule pcre option syntax “?P=name”

While trying to understand some SNORT rule lines, I came across the following syntax that I could not figure. Could not find any description in the manual (though admittedly I've not read it all ...
0
votes
1answer
564 views

What shoud I do for solving this problem ? Problem is about SNORT [closed]

Snort, daq and WinPcap are installed. The rule files are located at a convenient place. How can I solve this problem? A clue is the ERROR line: Missing/incorrect dynamic engine lib specifier.
0
votes
1answer
46 views

Multi flows snort rule

Is it possible to write a snort rule that match on 2 different flows? For instance on a communication from host-a <--> host-b that happen at the same time as a communication on host-a <--> ...
1
vote
1answer
609 views

Are my Snort rules correct?

I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason. Out of the three ...
4
votes
4answers
2k views

Unicast ARP Requests: Considered Harmful?

I'm playing around with Snort's downloadable rules and I found one which is easy to activate: sending a unicast ARP request. Okay, so I start injecting ARP requests, making sure the destination is not ...
1
vote
2answers
349 views

How to detect Snort on the network?

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.
1
vote
0answers
98 views

Barnyard2 Can't pull xref from unified2 format

I have snort configured to log unified2 in my snort.conf file and am using barnyard2 to parse the unified2 results. It works, except I can seem to figure out to pull the event reference (xref) out of ...
0
votes
3answers
184 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
1
vote
0answers
233 views

Snort sfportscan does not log in unified2 file format

I'm running Snort version 2.9.6.0 and I'm not able to log events from the sfportscan preprocessor using the unified2 file format. This is the conf (actually is the default one): preprocessor ...
2
votes
1answer
421 views

Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule)

I have the following rule: alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; ...
-1
votes
1answer
344 views

Snort / PulledPork event filter via modifysid.conf not filtering traffic [closed]

I'm using SecurityOnion with Snort/PulledPork/Snorby. I am getting multiple "ET POLICY Pandora Usage" alerts a minute for the same source and destination. I want to threshold these to get 1 alert per ...
4
votes
3answers
658 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
0
votes
1answer
1k views

How to use an OR condition with the content of a snort rule

I understand that if you specify multiple contents then the rule triggers only if ALL the content conditions are satisfied. But I want to create a rule that will trigger even if any one of the ...
0
votes
1answer
125 views

How to log packets which are allowed by SNORT?

Suppose i have not written rule for a type of attack in SNORT; It is obvious that it wont show any alerts. I wanna develop a system wherein i capture packets that SNORT allows n do further processing ...
1
vote
1answer
916 views

Block Packets in snort

In rules Configuration of snort , this is allowed: alert tcp any any -> any any (msg:"HTTP Connection"; react:block;) however when I write this is allowed: alert icmp any any -> any any ...