Snort is an open source network intrustion detection system
5
votes
3answers
8k views
Testing a Snort IDS installation
What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work?
alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
0
votes
2answers
732 views
Vulnerability scanner tools to use with Snort
We plan to add Snort with the firewall for our network to have improved security. The purpose, apart from protection from malicious traffic, is to customize Snort to detect and block specific traffic ...
5
votes
2answers
576 views
Snort Sensor Placement
I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
1
vote
1answer
128 views
Snort, add TCP retransmission rule
Can somebody help me with adding rule for packet retransmission.
I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
0
votes
1answer
263 views
Why aren't anomaly-based intrusion detection schemes implemented in Snort?
I have read many papers on anomaly-based network intrusion detection. Am I correct that each of their techniques could be implemented as Snort preprocessor? If this is true, why there are no anomaly ...
