Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

learn more… | top users | synonyms

2
votes
3answers
973 views

Reading Wireshark Result and Security Learning Recommendation

I am (not so) currently learning about security and right now I am learning about using Wireshark. I bumped into this video: ...
4
votes
1answer
477 views

SSL protocol issues on OS X and iOS

I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message: ...
0
votes
1answer
106 views

Is there a Snort rule that equates to “something suspicious flagged from a client side application?”

The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
3
votes
1answer
628 views

Help setting up Snort on Windows 7

I'm configuring Snort on Windows 7 with the help of this guy and I'm stuck at the following line in the config file: List of DNS servers on your network. I have multiple, how do I separate them? ...
4
votes
1answer
414 views

Logging True/False Negatives on Snort

I'm using Snort in a lab environmnet with artificially generated traffic. I'm looking to build a confusion matrix from known generated attacks. True Positives and False Positives are easy to parse ...
4
votes
2answers
1k views

Can you have 2 promiscuous (sniffing) ports on a single machine?

I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
10
votes
3answers
5k views

Snort's great, but BASE isn't. What are some alternative front-ends?

BASE is an improvement over ACID, but it's easy to tell that it's maintained by someone who doesn't use it. There's no at-a-glance overview of network activity like you get with McAfee's NUBA IDS and ...