Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

learn more… | top users | synonyms

4
votes
1answer
1k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
3
votes
1answer
172 views

Documentation on Snort rules and alert tuning, especially for new users

I just started using Snort. There is a lot to it. I'm just looking for better documentation of what some of the Snort rules actually mean -- i.e. How I should react to them when I have an alert for a ...
3
votes
1answer
95 views

How use snort with local.rules in offline mode?

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used. How can I show only the result ...
2
votes
1answer
104 views

Problem with Snort rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Get2 method"; flow: to_server, established; dsize: >20; sid:1000006; priority: 15) Snort does not generate any alert, whereas when I write the ...
0
votes
1answer
13 views

Questions on snort generating too many events and not sending to syslog

New to snort here. I downloaded snort (2.9.6.0 GRE Build 47) on my Ubuntu 14.04, also downloaded emergingthreat rules. I ran the following command root@myhp:~/pkgs/emergeThreats/snortRules# snort -...
0
votes
1answer
381 views

Question on SNORT Rule

I am new to SNORT and can not figure out what the following rule means: alert tcp $EXTERNAL_NET any-> $HOME_NET any (msg:"SCAN FIN"; flags: F; reference:arachnids,27;
3
votes
0answers
538 views

Security Onion:snorby alerts shows all local nerwork source IP(public and private)

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
2
votes
0answers
69 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
1
vote
0answers
14 views

Snort Modules Tweaking

I want to tweak and add new functionalities to snort code(Preprocessor)(v2.9.8). So,i have installed snort using source code,on ubuntu 14.04,however due to unknown problems,functionalities aren't ...
1
vote
0answers
42 views

Snort false positive, yet suspicious

I have Snort installed and tuned nicely with ET Rules on my pfSense, both my pfSense and the modem are using Googles public DNS 8.8.8.8. Recently I was denied access to google.com, and by reviewing ...
1
vote
0answers
11 views

Adding Windows 7 VM as a log source/forcing the IDS inline

I'm investigating ways to add my Windows 7 VM as a log source or even run that traffic through my IDS VM and then out to the internet but I'm not entirely sure how to approach it. Does anybody have ...
1
vote
0answers
201 views

Snort gives “could not create the registry key” error for multiple kinds of operations

I've set up a host-only network in Virtualbox consisting of a Kali linux machine and a Windows 7 machine (the host is running OS X). I have Snort installed on Windows 7 and am attempting to verify ...
1
vote
0answers
123 views

Barnyard2 Can't pull xref from unified2 format

I have snort configured to log unified2 in my snort.conf file and am using barnyard2 to parse the unified2 results. It works, except I can seem to figure out to pull the event reference (xref) out of ...
1
vote
0answers
309 views

Snort sfportscan does not log in unified2 file format

I'm running Snort version 2.9.6.0 and I'm not able to log events from the sfportscan preprocessor using the unified2 file format. This is the conf (actually is the default one): preprocessor ...
1
vote
0answers
647 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
0
votes
0answers
27 views

Snort rules fo detecting meterpreter sessions

I am learning configuring snort in my setup consisting of an attacker(linux), a victim(android smartphone) and 1 detection system. So far, i have been able to log all the packets between the attacker ...
0
votes
0answers
38 views

Frequency of Stealth scan?

Background I am working on snort Portscan Module to detect Stealth scans.Snort uses good amount of datastructures to capture scanning events and to explicitly set the threshold values. typedef ...
0
votes
0answers
47 views

is it normal that the alert file of snort is empty?

I installed snort on an ubuntu machine, then I created a simple rule to alert on ICMP packets. I started snort: snort -c /etc/snort/snort.conf -A console -l /var/log/snort and I sent a ping from ...
0
votes
0answers
29 views

Detecting Spamming activities of Botnets

Remarks Hello Everyone,thanks for being a nice platform for expressing Everyone's Doubts/Views. Problem Statement I want to detect spamming activity of botnets Background Information about ...
0
votes
0answers
27 views

Snort matching against single packets

For a specific task, I'd like to match snort rules against the first 1-2 packets of each flow in the network without waiting for the other subsequent flow packets. Can I do this with snort? If so, how?...
0
votes
0answers
172 views

Suricata IPS manual blocking/unblocking vs. snort and guardian

Does anyone have experience with using Suricata as an IPS? Im on Debian and I'd like to be able to manually block and unblock specific ip addresses (iptables). I've not used Suricata as I am currently ...
0
votes
0answers
121 views

Snort arpspoof preprocessor not giving alerts

I'm attempting to use Snort to detect a simple arpspoof attack on a test network I've set up. I have the following 4 ip addresses on this network. 192.168.1.1 Router 00:18:39:EC:F5:78 192.168.1.2 ...
0
votes
0answers
76 views

Snort rule to detect More Fragments fragbit not working

I have a Virtualbox setup with Snort running on a Windows 7 host and Kali Linux as the attacking machine, connected on an internal network. I'm investigating ways to get Snort to detect fragmentation ...
0
votes
0answers
120 views

Switching from Snort rules to Emerging Threats. Is there a way to know which ET rule sid covers the same vulnerabilty as Snort rule sid?

Our company has been using the snort community rules and we have tuned our rule files over years to our specific needs. Now our company has decided to use Emerging Threats (ET) open rules. The ET ...
0
votes
0answers
113 views

Snort rule does not work when combining “content” fields

I'm trying to write a snort rule which outputs an alert whenever a web server returns an HTML document containing a specific string. I've come up with the following rule: alert tcp any any -> any ...
0
votes
0answers
415 views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 (msg:"...
0
votes
0answers
51 views

Possible to run snort without modifiers?

Is there anyway (e.g some command line argument) with which we can tell snort to run and perform detection but without caring for the rule modifiers if there are any ? e.g alert tcp any any -> ...