Tagged Questions

1
vote
1answer
181 views

Are there any test cases to ensure the “web-attacks.rules” snort file works correctly?

I have set up an free evaluation Confluence Server on my local host and have configured "snort.conf" to point to my localhost as "HOME_NET" environment variable. I tried to test the ICMP rule by ...
6
votes
1answer
500 views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
2
votes
1answer
277 views

Categories of attacks in Snort

Is there any category for Snort rules that classifies them according to attcks such as U2R, R2L, .. ?!! Or how many well known attacks can it finds?!
1
vote
2answers
1k views

Snort false positive?

I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off: GPL SHELLCODE x86 inc ebx NOOP The payload is as ...