Tagged Questions
1
vote
1answer
184 views
Snort/IDS detect and alert on possible DoS/DDoS attack?
As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack.
Looking at the rulesets, which are primarily signature based rules, I can't see a ...
0
votes
1answer
37 views
How to specify a Snort rule connection duration?
Is it even possible to specify into a snort rule the duration of a connection?
For example: in this format Hour, Minute, Second
H, M, S = 0, 2, 1
If a connection that has the duration of 2 minutes ...
2
votes
1answer
86 views
How to add wildcards to snort rule ip address?
Is it possible to add wildcards or something that would function like them to a snort rule IP address?
For example:
If I'd like to detect source-ip of: 192.168.*.9
where the third octet can be ...
3
votes
1answer
232 views
Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?
I'm trying to develop an IDS/IPS system project to include these elements:
A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1)
A Linux server (Running Kismet server + client)
...
5
votes
1answer
253 views
Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice
I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the ...
1
vote
2answers
147 views
What type of data does Snort log?
This is new to me, but what types of data does Snort log for Network Intrusion Detection?
I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
1
vote
1answer
192 views
How to write Snort rules based on MAC address?
I would like to create Snort rules based on MAC addresses instead of IP addresses. Most devices on the network are DHCP assigned, and I would like to ignore certain traffic (ex: Dropbox) for some ...
2
votes
2answers
177 views
Enterprise IDS - Deployment & Uses
I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
5
votes
2answers
575 views
Snort Sensor Placement
I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
4
votes
1answer
255 views
Outbound TFTP request to 255.255.255.255
Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255
Anyone have a clue as to what this may ...
0
votes
1answer
92 views
Is there a Snort rule that equates to “something suspicious flagged from a client side application?”
The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
4
votes
2answers
660 views
Can you have 2 promiscuous (sniffing) ports on a single machine?
I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
