Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

learn more… | top users | synonyms

0
votes
1answer
46 views

How can I put snort in front of nginx server

I want to prevent attacks to my nginx server. How can I proxy the requests through snort to nginx server. NFQueue's are a solution.I am able to pass packets to snort using the following rules sudo ...
0
votes
2answers
38 views

How to make sense of, and act on, Snort Rules?

I am a relatively new Snort user with years of sys admin experience. I feel that I must be missing something, because I find Snort rules to be completely undocumented and incomprehensible. Because of ...
0
votes
1answer
51 views

Snort - Rule: Alert all php requests

I am trying to understand writing rules for snort. Further goal is detection of sql injections like here. I've read the documentation of snort rules and created this rule: alert tcp any any -> ...
0
votes
0answers
27 views

Snort rule does not work when combining “content” fields

I'm trying to write a snort rule which outputs an alert whenever a web server returns an HTML document containing a specific string. I've come up with the following rule: alert tcp any any -> any ...
3
votes
1answer
68 views

How to detect changing IP address and user agent on a HTTP session?

I have some HTTP logs where I see the hacker changing his IP every request, and occasionally changing his useragent. Is there a way to detect this automatically? Perhaps a snort rule? or any other ...
0
votes
1answer
61 views

Snort: Arpspoof preprocessor events not showing up in BASE UI

I have followed this guide to install Snort, using Barnyard2, BASE, IIS, and MySql. My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted ...
2
votes
0answers
78 views

Snort alerts analysis (web interface) [closed]

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
1
vote
1answer
73 views

Question on SNORT Rule

I am new to SNORT and can not figure out what the following rule means: alert tcp $EXTERNAL_NET any-> $HOME_NET any (msg:"SCAN FIN"; flags: F; reference:arachnids,27;
-1
votes
1answer
90 views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
1
vote
1answer
86 views

Snort report - 1000+ alerts in 1 minute from port 5060

I woke up this morning and could see over 1000+ of these alerts. They came in the time space 23:34 - 23:35. Can anybody tell me what that was about and should I be worried for an eventual DDoS ...
4
votes
1answer
103 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
0
votes
0answers
146 views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 ...
2
votes
1answer
220 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
1
vote
0answers
94 views

Snort rule for outgoing attacks [closed]

I have a pcap file captured from a user PC. I need to analyze whether it has initialized a DOS attack to any server. alert tcp any any -> any 8080 (msg:"DOS flood denial of service attempt"; ...
0
votes
1answer
396 views

How to run a snort rule over pcap file

I have a pcap file, and what I wanted to know is how can I apply the Snortrule below which I've already written within the rules folder in my log folder: alert icmp any any -> any any (msg:"TCP ...
0
votes
0answers
47 views

What is a Packet Identifier (pid) used for?

I'm trying to analyze a pcap file using snort using the following command: snort -r file.pcap I got the output which had n number of packets and at the top i had this Packet Identifier pid=14782. ...
1
vote
0answers
349 views

How can I find threats/attacks from a PCAP - Wireshark, Snort [closed]

I have a pcap file and I am trying to analyze it using Snort and Wireshark. When I tried the command, which I had showed below, in Ubuntu I was provided with various output such as the date, time, ...
1
vote
1answer
81 views

What could this set of IDS alerts be (DDNS deaftone.com darktech.org chatnook.com, …)?

Below is a screeny of my Squert GUI showing the Snort events. Notice they all happen at the same exact time. I cannot figure out what the source of it could be. Any ideas? Edit: It looks like the ...
0
votes
1answer
145 views

Using OpenAppID without Snort [closed]

Cisco Security introduced open source application detection and control mechanism which called "OpenAppID". Which can be checked in the link Lets say I have a sniffer application for myself; if I ...
2
votes
1answer
462 views

Snort IDS for Amazon deployment

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt ...
1
vote
0answers
50 views

Snort only detect local issues [closed]

I have installed two physical machines with KVM virtualization using Red Hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 In h2 the virtual machines w2 , db1 and ids. ...
0
votes
0answers
42 views

Possible to run snort without modifiers?

Is there anyway (e.g some command line argument) with which we can tell snort to run and perform detection but without caring for the rule modifiers if there are any ? e.g alert tcp any any -> ...
1
vote
2answers
48 views

Separate normal traffic [closed]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...
2
votes
1answer
50 views

I want to filter Snort rules by date written [closed]

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
0
votes
1answer
86 views

Where does Snort log the messages when using a pcap file?

When you're using Snort for real-time monitoring the messages are logged to /var/log/snort/alerts. However, when you load a pcap file, where do you see if any packet triggered a rule? Because they ...
0
votes
1answer
175 views

Snort Rule Comparison

As far as I read, Emerging threats and VRT Snort rules are available freely, and also Pro (fee based). Is there any comparision, or anything to suggest choose one over another? What are the benefits ...
4
votes
2answers
1k views

Can installing Snort make me vulnerable?

I am using Ubuntu and am wondering if installing Snort on my host can make me more vulnerable?
0
votes
3answers
232 views

Is there any hardware solution for IDS? [closed]

Are there any products that let you see and set IDS [Intrusion detection system] on router or any another hardware that is connected to the router? All the ones I have found of them are Operating ...
0
votes
1answer
237 views

How can I test a DoS attack against snort?

I need to set up an scenario where an attacker DoS attacks port 80 of an server while snort and others users try to connect to port 80 at the same time. Something like this: 1000 connections to port ...
0
votes
1answer
83 views

What does this Snort rule do? [closed]

Rule-4: alert udp $EXTERNAL_NET any -> $HOME_NET 3333 (msg:"ET EXPLOIT Wireshark ENTTEC DMX Data Processing Code Execution Attempt 1"; content:"|45 53 44 44|"; depth:4; content:"|04|"; ...
0
votes
1answer
138 views

SNORT alert for Trufflehunter SFVRT 3:29312:1

I am seeing this Snort alert show up multiple times a day, but my Google-foo is failing me, as I can not find any information about this alert on the internet. Can anyone point me in the direction ...
0
votes
2answers
468 views

honeyd is still a good alternative?

I've been investigating to deploy a honeypot for research purpose, Honeyd seems like the most popular and adequate option to my needs, but it seems too old, the last version of this software was ...
0
votes
2answers
460 views

Can't understand SNORT rule pcre option syntax “?P=name”

While trying to understand some SNORT rule lines, I came across the following syntax that I could not figure. Could not find any description in the manual (though admittedly I've not read it all ...
0
votes
1answer
523 views

What shoud I do for solving this problem ? Problem is about SNORT [closed]

Snort, daq and WinPcap are installed. The rule files are located at a convenient place. How can I solve this problem? A clue is the ERROR line: Missing/incorrect dynamic engine lib specifier.
0
votes
1answer
43 views

Multi flows snort rule

Is it possible to write a snort rule that match on 2 different flows? For instance on a communication from host-a <--> host-b that happen at the same time as a communication on host-a <--> ...
1
vote
1answer
523 views

Are my Snort rules correct?

I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason. Out of the three ...
4
votes
4answers
2k views

Unicast ARP Requests: Considered Harmful?

I'm playing around with Snort's downloadable rules and I found one which is easy to activate: sending a unicast ARP request. Okay, so I start injecting ARP requests, making sure the destination is not ...
1
vote
2answers
311 views

How to detect Snort on the network?

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.
1
vote
0answers
92 views

Barnyard2 Can't pull xref from unified2 format

I have snort configured to log unified2 in my snort.conf file and am using barnyard2 to parse the unified2 results. It works, except I can seem to figure out to pull the event reference (xref) out of ...
0
votes
3answers
161 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
1
vote
0answers
218 views

Snort sfportscan does not log in unified2 file format

I'm running Snort version 2.9.6.0 and I'm not able to log events from the sfportscan preprocessor using the unified2 file format. This is the conf (actually is the default one): preprocessor ...
2
votes
1answer
398 views

Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule)

I have the following rule: alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; ...
-1
votes
1answer
316 views

Snort / PulledPork event filter via modifysid.conf not filtering traffic [closed]

I'm using SecurityOnion with Snort/PulledPork/Snorby. I am getting multiple "ET POLICY Pandora Usage" alerts a minute for the same source and destination. I want to threshold these to get 1 alert per ...
4
votes
3answers
618 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
0
votes
1answer
903 views

How to use an OR condition with the content of a snort rule

I understand that if you specify multiple contents then the rule triggers only if ALL the content conditions are satisfied. But I want to create a rule that will trigger even if any one of the ...
0
votes
1answer
102 views

How to log packets which are allowed by SNORT?

Suppose i have not written rule for a type of attack in SNORT; It is obvious that it wont show any alerts. I wanna develop a system wherein i capture packets that SNORT allows n do further processing ...
1
vote
1answer
760 views

Block Packets in snort

In rules Configuration of snort , this is allowed: alert tcp any any -> any any (msg:"HTTP Connection"; react:block;) however when I write this is allowed: alert icmp any any -> any any ...
1
vote
0answers
413 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
5
votes
1answer
1k views

Snort alert log simple question

I am analyzing Snort alert log and cannot figure what [1:1071:6] means in 10/12-12:44:28.793118 [**] [1:1071:6] WEB-MISC .htpasswd access [**] [Classification: Web Application Attack] [Priority: 1] ...
0
votes
1answer
262 views

IDS false positive rates

Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at ...