Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

learn more… | top users | synonyms

4
votes
1answer
981 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
0
votes
0answers
28 views

is it normal that the alert file of snort is empty?

I installed snort on an ubuntu machine, then I created a simple rule to alert on ICMP packets. I started snort: snort -c /etc/snort/snort.conf -A console -l /var/log/snort and I sent a ping from ...
4
votes
1answer
115 views

Documentation on Snort rules and alert tuning, especially for new users

I just started using Snort. There is a lot to it. I'm just looking for better documentation of what some of the Snort rules actually mean -- i.e. How I should react to them when I have an alert for a ...
0
votes
1answer
353 views

Question on SNORT Rule

I am new to SNORT and can not figure out what the following rule means: alert tcp $EXTERNAL_NET any-> $HOME_NET any (msg:"SCAN FIN"; flags: F; reference:arachnids,27;
1
vote
0answers
13 views

Snort Modules Tweaking

I want to tweak and add new functionalities to snort code(Preprocessor)(v2.9.8). So,i have installed snort using source code,on ubuntu 14.04,however due to unknown problems,functionalities aren't ...
2
votes
1answer
91 views

Problem with Snort rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Get2 method"; flow: to_server, established; dsize: >20; sid:1000006; priority: 15) Snort does not generate any alert, whereas when I write the ...
3
votes
1answer
90 views

How use snort with local.rules in offline mode?

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used. How can I show only the result ...
1
vote
0answers
34 views

Snort false positive, yet suspicious

I have Snort installed and tuned nicely with ET Rules on my pfSense, both my pfSense and the modem are using Googles public DNS 8.8.8.8. Recently I was denied access to google.com, and by reviewing ...
0
votes
0answers
26 views

Detecting Spamming activities of Botnets

Remarks Hello Everyone,thanks for being a nice platform for expressing Everyone's Doubts/Views. Problem Statement I want to detect spamming activity of botnets Background Information about ...
2
votes
0answers
58 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
1
vote
2answers
9k views

How to connect sensors such as Snort to AlienVault SIEM?

I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?
1
vote
2answers
27 views

Snort Unable to detect portscans in LAN

Setup Information I am doing experiment on portscan detection using snort 2.9.8.I have 10 systems in my lab with id:1,2,3,...,10. i have installed snort in my lab-pc with id:1.Now i am using Pc with ...
4
votes
1answer
81 views

How do I use a directory of YARA files?

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...
1
vote
0answers
11 views

snort spp_sfPortscan Preprocessor Customization [closed]

I am working in snort 2.9.8.0. I want to modify the snort code for Portscanning Detection,i.e spp_sfPortscan.c and its related code to build a customized portScan detector. Ex:suppose A is scanning ...
1
vote
2answers
224 views

Snort “Protocol mismatch” from SSH preprocessor

TL;DR -- What does "protocol mismatch" even mean, and how is this a threat? Can I just suppress it? We are busy tuning Snort. The SSH preprocessor section looks like this, which comes directly from ...
0
votes
1answer
133 views

(spp_sdf) SDF Combination Alerts in Snort

I'm testing Snort in IDS mode and have been receiving a few (spp_sdf) SDF Combination Alerts as below. Seems like it happens when I visit certain but not all https sites. Tried to google this alert ...
1
vote
1answer
76 views

Are snort rules applied per packet or per flow

I would like to understand if snort rules are applied for each packet in a flow between a source and destination separately? For instance, when packet 1 of the flow arrives at the IDS, all the rules ...
0
votes
1answer
70 views

snort rule to detect relay attempt not working

I am trying to detect a relay attempt on smtp server, but nothing gets logs when I test it out. The snort rule to detect a relay attempt which I tried using is: alert tcp $SMTP_SERVERS 25 -> ...
0
votes
0answers
24 views

Snort matching against single packets

For a specific task, I'd like to match snort rules against the first 1-2 packets of each flow in the network without waiting for the other subsequent flow packets. Can I do this with snort? If so, ...
0
votes
0answers
141 views

Suricata IPS manual blocking/unblocking vs. snort and guardian

Does anyone have experience with using Suricata as an IPS? Im on Debian and I'd like to be able to manually block and unblock specific ip addresses (iptables). I've not used Suricata as I am currently ...
0
votes
1answer
68 views

What does this snort rule mean?

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-BACKDOOR access remote pc runtime detection - init connection"; flow:to_server,established; content:"|99 F3 00 00 00 00 00 00 FF FF FF ...
3
votes
1answer
68 views

How to make Snort not log sensitive data from the sniffed traffic?

I have Snort in my network which I use for IDS and it is residing on a VM that receives all mirrored traffic from the switch. I am having a web applications that users use and they login, operate on ...
0
votes
0answers
80 views

Snort arpspoof preprocessor not giving alerts

I'm attempting to use Snort to detect a simple arpspoof attack on a test network I've set up. I have the following 4 ip addresses on this network. 192.168.1.1 Router 00:18:39:EC:F5:78 192.168.1.2 ...
0
votes
0answers
65 views

Snort rule to detect More Fragments fragbit not working

I have a Virtualbox setup with Snort running on a Windows 7 host and Kali Linux as the attacking machine, connected on an internal network. I'm investigating ways to get Snort to detect fragmentation ...
1
vote
0answers
38 views

Snort signatures not working [closed]

I am using snort to detect signature for IDS but some rule not detected by snort which is highlighted below. Kindly, sort this out, I'm stuck here.
0
votes
0answers
80 views

Switching from Snort rules to Emerging Threats. Is there a way to know which ET rule sid covers the same vulnerabilty as Snort rule sid?

Our company has been using the snort community rules and we have tuned our rule files over years to our specific needs. Now our company has decided to use Emerging Threats (ET) open rules. The ET ...
1
vote
1answer
73 views

Understanding Snort log

I am new to Snort, and I have ran Snort through a .cap file and got the logs that I should interpret. If I take for instance a block of log like the one below: [**] [1:2463:7] EXPLOIT IGMP IGAP ...
0
votes
1answer
76 views

fwsnort - How safe compared with Snort/Suricata

How safe is 'fwsnort' compared to a real Snort / Suricata instance? Whats the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is ...
1
vote
0answers
11 views

Adding Windows 7 VM as a log source/forcing the IDS inline

I'm investigating ways to add my Windows 7 VM as a log source or even run that traffic through my IDS VM and then out to the internet but I'm not entirely sure how to approach it. Does anybody have ...
1
vote
0answers
13 views

get session data (stream data) into Snort ids [closed]

Can any one point to me where (in the code) Snort are stored just before they send to httprespect or got written to the output files? Thanks.
1
vote
0answers
161 views

Snort gives “could not create the registry key” error for multiple kinds of operations

I've set up a host-only network in Virtualbox consisting of a Kali linux machine and a Windows 7 machine (the host is running OS X). I have Snort installed on Windows 7 and am attempting to verify ...
-1
votes
1answer
302 views

snort rule explanation

I'm quite new to Snort, Could anyone explain these two rules? Specifically, why do they contain more than one "content" field ? alert tcp $EXTERNAL_NET any -> $HOME_NET any ( msg:"ET TROJAN Reply ...
1
vote
1answer
123 views

SNORT sfportscan alert format [closed]

How can I modify the output alert from sfportscan ? Ex : output alert_csv: /var/log/snort/portscan.log timestamp,src,dst,dstport,msg OBS: I can set output for default alert file with this method ?
19
votes
5answers
3k views

DoS in local network computer

I'm using Snort to study detection, and I wanted to simulate a DoS attack from the inside to another computer in my home network, but I have a question. If I start to flood the target computer with ...
5
votes
2answers
255 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
0
votes
1answer
66 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
1
vote
1answer
261 views

What does the http_uri content modifier do is SNORT

I am very confused about exactly what http_uri does. Can someone explain this to me w.r.t NORMALIZED and UNNORMALIZED uri fields?
0
votes
2answers
448 views

How to make sense of, and act on, Snort Rules?

I am a relatively new Snort user with years of sys admin experience. I feel that I must be missing something, because I find Snort rules to be completely undocumented and incomprehensible. Because of ...
0
votes
1answer
212 views

Snort - Rule: Alert all php requests

I am trying to understand writing rules for snort. Further goal is detection of sql injections like here. I've read the documentation of snort rules and created this rule: alert tcp any any -> ...
0
votes
0answers
102 views

Snort rule does not work when combining “content” fields

I'm trying to write a snort rule which outputs an alert whenever a web server returns an HTML document containing a specific string. I've come up with the following rule: alert tcp any any -> any ...
3
votes
1answer
362 views

How to detect changing IP address and user agent on a HTTP session?

I have some HTTP logs where I see the hacker changing his IP every request, and occasionally changing his useragent. Is there a way to detect this automatically? Perhaps a snort rule? or any other ...
0
votes
1answer
300 views

Snort: Arpspoof preprocessor events not showing up in BASE UI

I have followed this guide to install Snort, using Barnyard2, BASE, IIS, and MySql. My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted ...
1
vote
0answers
260 views

Snort alerts analysis (web interface) [closed]

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
1
vote
1answer
485 views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
1
vote
1answer
110 views

Snort report - 1000+ alerts in 1 minute from port 5060

I woke up this morning and could see over 1000+ of these alerts. They came in the time space 23:34 - 23:35. Can anybody tell me what that was about and should I be worried for an eventual DDoS ...
0
votes
1answer
278 views

Using OpenAppID without Snort [closed]

Cisco Security introduced open source application detection and control mechanism which called "OpenAppID". Which can be checked in the link Lets say I have a sniffer application for myself; if I ...
1
vote
1answer
2k views

Block Packets in snort

In rules Configuration of snort , this is allowed: alert tcp any any -> any any (msg:"HTTP Connection"; react:block;) however when I write this is allowed: alert icmp any any -> any any ...
2
votes
1answer
81 views

I want to filter Snort rules by date written [closed]

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
0
votes
0answers
385 views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 ...
1
vote
0answers
221 views

Snort rule for outgoing attacks [closed]

I have a pcap file captured from a user PC. I need to analyze whether it has initialized a DOS attack to any server. alert tcp any any -> any 8080 (msg:"DOS flood denial of service attempt"; ...