Snort is an open source network intrustion detection system
-3
votes
1answer
70 views
Web GUI for Snort + ModSecurity [closed]
I'm trying to find a suitable (or easily modifiable) web GUI for snort + modsecurity logs. As far as I know, Splunk can do that by installing the snort and modsecurity plugins. Is there any other ...
3
votes
1answer
79 views
What is the danger of the “FTP RNFR ././ attempt”?
I am analysing an old attack and I got a scenario which does not really make sense to me.
The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as ...
1
vote
0answers
66 views
Security Onion:snorby alerts shows all local nerwork source IP(public and private)
I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
1
vote
1answer
184 views
Snort/IDS detect and alert on possible DoS/DDoS attack?
As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack.
Looking at the rulesets, which are primarily signature based rules, I can't see a ...
0
votes
1answer
37 views
How to specify a Snort rule connection duration?
Is it even possible to specify into a snort rule the duration of a connection?
For example: in this format Hour, Minute, Second
H, M, S = 0, 2, 1
If a connection that has the duration of 2 minutes ...
2
votes
1answer
86 views
How to add wildcards to snort rule ip address?
Is it possible to add wildcards or something that would function like them to a snort rule IP address?
For example:
If I'd like to detect source-ip of: 192.168.*.9
where the third octet can be ...
3
votes
1answer
148 views
COMMUNITY SIP TCP/IP message flooding directed to SIP proxy
I have installed Snort IDS and most alarm is:
"COMMUNITY SIP TCP/IP message flooding directed to SIP proxy"
And i use home DSL Internet connection , should i be worried about this alarm ?
I have ...
2
votes
1answer
239 views
Snort (IDS) Don't show Port Scans
I have install Snort & acidbase by this instruction and access it through this local address
127.0.0.1/acidbase/base_main.php
The problem is after scan it with nmap by this command
sudo ...
1
vote
1answer
140 views
snort ignores packets with matching src/dest IP address
This is my rule:
alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;)
I am running snort against a precaptured packet file where there are UDP packets that ...
0
votes
0answers
157 views
Snort Parallelization Techniques and its effect on DDOS detection capability
I want to ask a query about snort parallelization.
1) Can snort detection rate remains same for all attacks after parallelisation?
2) As the parallelisation of netowrk traffic in each core is based ...
3
votes
1answer
232 views
Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?
I'm trying to develop an IDS/IPS system project to include these elements:
A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1)
A Linux server (Running Kismet server + client)
...
1
vote
1answer
127 views
Snort, add TCP retransmission rule
Can somebody help me with adding rule for packet retransmission.
I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
5
votes
1answer
253 views
Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice
I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the ...
1
vote
2answers
147 views
What type of data does Snort log?
This is new to me, but what types of data does Snort log for Network Intrusion Detection?
I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
1
vote
1answer
180 views
Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?
I have set up an free evaluation Confluence Server on my local host and have configured "snort.conf" to point to my localhost as "HOME_NET" environment variable.
I tried to test the ICMP rule by ...
1
vote
1answer
192 views
How to write Snort rules based on MAC address?
I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some ...
1
vote
0answers
91 views
Swatch installation's issue to detect intrusion
I have installed snort and I want to use the swatch tool to send me an email when it detects something going wrong. I am using OSX and I followed the installation guide: ...
0
votes
1answer
261 views
Why aren't anomaly-based intrusion detection schemes implemented in Snort?
I have read many papers on anomaly-based network intrusion detection. Am I correct that each of their techniques could be implemented as Snort preprocessor? If this is true, why there are no anomaly ...
0
votes
3answers
438 views
Using an IPS as an alternative to mod_security
I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such ...
2
votes
2answers
177 views
Enterprise IDS - Deployment & Uses
I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
0
votes
1answer
255 views
Interpreting Snort's stream5 alerts
I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index.
Snort is showing me a huge amount of, in particular, these two ...
3
votes
2answers
118 views
Taking action for exploit attempts
Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of ...
2
votes
1answer
232 views
Open source or common implementations for reverse proxy web application security
I realize there is already a question similar to this one, but this is somewhat of a follow-up.
I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...
6
votes
1answer
495 views
How can an admin choose which Snort rules to enable?
The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection
attacks, port ...
2
votes
1answer
779 views
Snort & Logging
I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me.
I would like to use Snort to perform a trace, which, after it ...
5
votes
2answers
575 views
Snort Sensor Placement
I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
4
votes
1answer
255 views
Outbound TFTP request to 255.255.255.255
Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255
Anyone have a clue as to what this may ...
-1
votes
1answer
2k views
Snort rules question [closed]
I just noticed my snort rules fired today on this, on a brand new ossim server I was testing.
"shellcode x86 inc ebx noo" on with the source ip from Canada.
The destination was my ossim server.
Any ...
4
votes
1answer
736 views
Bench marking Snort and other IDS/IPS
I am looking for facts and figures of research or surveys done which have bench-marked Snort with other IDS/IPS on various parameters like overall performance, accuracy, speed, documentation, ...
5
votes
3answers
8k views
Testing a Snort IDS installation
What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work?
alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
1
vote
2answers
2k views
How to connect sensors to AlienVault?
I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?
0
votes
2answers
732 views
Vulnerability scanner tools to use with Snort
We plan to add Snort with the firewall for our network to have improved security. The purpose, apart from protection from malicious traffic, is to customize Snort to detect and block specific traffic ...
2
votes
1answer
274 views
Categories of attacks in Snort
Is there any category for Snort rules that classifies them according to attcks such as U2R, R2L, .. ?!!
Or how many well known attacks can it finds?!
0
votes
2answers
474 views
What IDS Do you recommend? [closed]
I am running a Debian Squeeze VPS and need a good IDS. I have used snort before and it was quite good but i am wandering if there are any other good ones out there.
Preferably compatible with ...
0
votes
2answers
1k views
Snort false positive?
I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off:
GPL SHELLCODE x86 inc ebx NOOP
The payload is as ...
1
vote
3answers
793 views
Reading Wireshark Result and Security Learning Recommendation
I am (not so) currently learning about security and right now I am learning about using Wireshark. I bumped into this video:
...
4
votes
1answer
226 views
SSL protocol issues on OS X and iOS
I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message:
...
0
votes
1answer
92 views
Is there a Snort rule that equates to “something suspicious flagged from a client side application?”
The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
2
votes
1answer
511 views
Help setting up Snort on Windows 7
I'm configuring Snort on Windows 7 with the help of this guy and I'm stuck at the following line in the config file:
List of DNS servers on your network.
I have multiple, how do I separate them? ...
4
votes
1answer
301 views
Logging True/False Negatives on Snort
I'm using Snort in a lab environmnet with artificially generated traffic.
I'm looking to build a confusion matrix from known generated attacks.
True Positives and False Positives are easy to parse ...
4
votes
2answers
660 views
Can you have 2 promiscuous (sniffing) ports on a single machine?
I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
9
votes
2answers
3k views
Snort's great, but BASE isn't. What are some alternative front-ends?
BASE is an improvement over ACID, but it's easy to tell that it's maintained by someone who doesn't use it. There's no at-a-glance overview of network activity like you get with McAfee's NUBA IDS and ...
