Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

learn more… | top users | synonyms

5
votes
1answer
131 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
2
votes
1answer
268 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
2
votes
0answers
10 views

SNORT sfportscan alert format

How can I modify the output alert from sfportscan ? Ex : output alert_csv: /var/log/snort/portscan.log timestamp,src,dst,dstport,msg OBS: I can set output for default alert file with this method ?
2
votes
0answers
409 views

Security Onion:snorby alerts shows all local nerwork source IP(public and private)

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
1
vote
0answers
95 views

Barnyard2 Can't pull xref from unified2 format

I have snort configured to log unified2 in my snort.conf file and am using barnyard2 to parse the unified2 results. It works, except I can seem to figure out to pull the event reference (xref) out of ...
1
vote
0answers
226 views

Snort sfportscan does not log in unified2 file format

I'm running Snort version 2.9.6.0 and I'm not able to log events from the sfportscan preprocessor using the unified2 file format. This is the conf (actually is the default one): preprocessor ...
1
vote
0answers
422 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
0
votes
0answers
31 views

Snort rule does not work when combining “content” fields

I'm trying to write a snort rule which outputs an alert whenever a web server returns an HTML document containing a specific string. I've come up with the following rule: alert tcp any any -> any ...
0
votes
0answers
163 views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 ...
0
votes
0answers
58 views

What is a Packet Identifier (pid) used for?

I'm trying to analyze a pcap file using snort using the following command: snort -r file.pcap I got the output which had n number of packets and at the top i had this Packet Identifier pid=14782. ...
0
votes
0answers
43 views

Possible to run snort without modifiers?

Is there anyway (e.g some command line argument) with which we can tell snort to run and perform detection but without caring for the rule modifiers if there are any ? e.g alert tcp any any -> ...