Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

learn more… | top users | synonyms

1
vote
1answer
177 views

Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule)

I have the following rule: alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; ...
0
votes
1answer
27 views

Multi flows snort rule

Is it possible to write a snort rule that match on 2 different flows? For instance on a communication from host-a <--> host-b that happen at the same time as a communication on host-a <--> ...
2
votes
0answers
257 views

Security Onion:snorby alerts shows all local nerwork source IP(public and private)

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
2
votes
0answers
191 views

Snort Parallelization Techniques and its effect on DDOS detection capability

I want to ask a query about snort parallelization. 1) Can snort detection rate remains same for all attacks after parallelisation? 2) As the parallelisation of netowrk traffic in each core is based ...
1
vote
0answers
121 views

Snort sfportscan does not log in unified2 file format

I'm running Snort version 2.9.6.0 and I'm not able to log events from the sfportscan preprocessor using the unified2 file format. This is the conf (actually is the default one): preprocessor ...
1
vote
0answers
180 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
0
votes
0answers
31 views

Barnyard2 Can't pull xref from unified2 format

I have snort configured to log unified2 in my snort.conf file and am using barnyard2 to parse the unified2 results. It works, except I can seem to figure out to pull the event reference (xref) out of ...