Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

learn more… | top users | synonyms

10
votes
3answers
7k views

Snort's great, but BASE isn't. What are some alternative front-ends?

BASE is an improvement over ACID, but it's easy to tell that it's maintained by someone who doesn't use it. There's no at-a-glance overview of network activity like you get with McAfee's NUBA IDS and ...
6
votes
4answers
28k views

Testing Snort IDS installation

What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work? alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
6
votes
1answer
1k views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
5
votes
2answers
2k views

Snort Sensor Placement

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
5
votes
1answer
747 views

Snort alert log simple question

I am analyzing Snort alert log and cannot figure what [1:1071:6] means in 10/12-12:44:28.793118 [**] [1:1071:6] WEB-MISC .htpasswd access [**] [Classification: Web Application Attack] [Priority: 1] ...
5
votes
1answer
740 views

Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice

I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the ...
4
votes
2answers
1k views

Can installing Snort make me vulnerable?

I am using Ubuntu and am wondering if installing Snort on my host can make me more vulnerable?
4
votes
1answer
2k views

Bench marking Snort and other IDS/IPS

I am looking for facts and figures of research or surveys done which have bench-marked Snort with other IDS/IPS on various parameters like overall performance, accuracy, speed, documentation, ...
4
votes
4answers
1k views

Unicast ARP Requests: Considered Harmful?

I'm playing around with Snort's downloadable rules and I found one which is easy to activate: sending a unicast ARP request. Okay, so I start injecting ARP requests, making sure the destination is not ...
4
votes
3answers
514 views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
4
votes
1answer
666 views

Outbound TFTP request to 255.255.255.255

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255 Anyone have a clue as to what this may ...
4
votes
2answers
2k views

Can you have 2 promiscuous (sniffing) ports on a single machine?

I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
4
votes
2answers
152 views

Taking action for exploit attempts

Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of ...
4
votes
1answer
716 views

Help setting up Snort on Windows 7

I'm configuring Snort on Windows 7 with the help of this guy and I'm stuck at the following line in the config file: List of DNS servers on your network. I have multiple, how do I separate them? ...
4
votes
1answer
523 views

Logging True/False Negatives on Snort

I'm using Snort in a lab environmnet with artificially generated traffic. I'm looking to build a confusion matrix from known generated attacks. True Positives and False Positives are easy to parse ...
4
votes
2answers
6k views

Snort (IDS) Don't show Port Scans

I have install Snort & acidbase by this instruction and access it through this local address 127.0.0.1/acidbase/base_main.php The problem is after scan it with nmap by this command sudo ...
4
votes
1answer
673 views

SSL protocol issues on OS X and iOS

I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message: ...
3
votes
1answer
331 views

What is the danger of the “FTP RNFR ././ attempt”?

I am analysing an old attack and I got a scenario which does not really make sense to me. The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as ...
3
votes
1answer
1k views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
3
votes
3answers
1k views

Reading Wireshark Result and Security Learning Recommendation

I am (not so) currently learning about security and right now I am learning about using Wireshark. I bumped into this video: ...
2
votes
3answers
2k views

Using an IPS as an alternative to mod_security

I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such ...
2
votes
2answers
407 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
2
votes
1answer
656 views

How to add wildcards to snort rule ip address?

Is it possible to add wildcards or something that would function like them to a snort rule IP address? For example: If I'd like to detect source-ip of: 192.168.*.9 Where the third octet can be ...
2
votes
1answer
645 views

Open source or common implementations for reverse proxy web application security

I realize there is already a question similar to this one, but this is somewhat of a follow-up. I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...
2
votes
1answer
133 views

Snort IDS for Amazon deployment

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt ...
2
votes
1answer
296 views

Snort Rule Writing (Alert Fires But Traffic Does Not Match *Intended* Rule)

I have the following rule: alert tcp $HOME_NET any > $EXTERNAL_NET any (msg:"This should not happen"; flow:established,to_server; content:"GET "; depth:4; content:"Set-Cookie:"; http_header; ...
2
votes
1answer
4k views

Snort/IDS detect and alert on possible DoS/DDoS attack?

As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack. Looking at the rulesets, which are primarily signature based rules, I can't see a ...
2
votes
1answer
908 views

COMMUNITY SIP TCP/IP message flooding directed to SIP proxy

I have installed Snort IDS and most alarm is: "COMMUNITY SIP TCP/IP message flooding directed to SIP proxy" And i use home DSL Internet connection , should i be worried about this alarm ? I have ...
2
votes
1answer
672 views

snort ignores packets with matching src/dest IP address

This is my rule: alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;) I am running snort against a precaptured packet file where there are UDP packets that ...
2
votes
1answer
178 views

Swatch installation's issue to detect intrusion

I have installed snort and I want to use the swatch tool to send me an email when it detects something going wrong. I am using OSX and I followed the installation guide: ...
2
votes
1answer
2k views

Snort & Logging

I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me. I would like to use Snort to perform a trace, which, after it ...
2
votes
1answer
799 views

Classification of attacks in network specially in Snort IDS

What are the main classification of attacks in network and specially in Snort IDS?! Is it possible to power up the Snort by classifying the attack into for 5 main groups, for example; R2L, U2R etc. ...
2
votes
1answer
38 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
2
votes
1answer
36 views

I want to filter Snort rules by date written [closed]

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
2
votes
0answers
323 views

Security Onion:snorby alerts shows all local nerwork source IP(public and private)

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
2
votes
0answers
210 views

Snort Parallelization Techniques and its effect on DDOS detection capability [closed]

I want to ask a query about snort parallelization. 1) Can snort detection rate remains same for all attacks after parallelisation? 2) As the parallelisation of netowrk traffic in each core is based ...
1
vote
2answers
6k views

How to connect sensors such as Snort to AlienVault SIEM?

I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?
1
vote
2answers
845 views

What type of data does Snort log?

This is new to me, but what types of data does Snort log for Network Intrusion Detection? I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
1
vote
2answers
3k views

Snort false positive?

I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off: GPL SHELLCODE x86 inc ebx NOOP The payload is as ...
1
vote
2answers
243 views

How to detect Snort on the network?

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.
1
vote
1answer
554 views

Block Packets in snort

In rules Configuration of snort , this is allowed: alert tcp any any -> any any (msg:"HTTP Connection"; react:block;) however when I write this is allowed: alert icmp any any -> any any ...
1
vote
1answer
61 views

What could this set of IDS alerts be (DDNS deaftone.com darktech.org chatnook.com, …)?

Below is a screeny of my Squert GUI showing the Snort events. Notice they all happen at the same exact time. I cannot figure out what the source of it could be. Any ideas? Edit: It looks like the ...
1
vote
1answer
939 views

Snort, add TCP retransmission rule

Can somebody help me with adding rule for packet retransmission. I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
1
vote
2answers
1k views

Vulnerability scanner tools to use with Snort

We plan to add Snort with the firewall for our network to have improved security. The purpose, apart from protection from malicious traffic, is to customize Snort to detect and block specific traffic ...
1
vote
2answers
1k views

What IDS Do you recommend? [closed]

I am running a Debian Squeeze VPS and need a good IDS. I have used snort before and it was quite good but i am wandering if there are any other good ones out there. Preferably compatible with ...
1
vote
1answer
47 views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
1
vote
0answers
34 views

Snort rule for outgoing attacks [closed]

I have a pcap file captured from a user PC. I need to analyze whether it has initialized a DOS attack to any server. alert tcp any any -> any 8080 (msg:"DOS flood denial of service attempt"; ...
1
vote
0answers
114 views

How can I find threats/attacks from a PCAP - Wireshark, Snort [closed]

I have a pcap file and I am trying to analyze it using Snort and Wireshark. When I tried the command, which I had showed below, in Ubuntu I was provided with various output such as the date, time, ...
1
vote
0answers
37 views

Snort only detect local issues [closed]

I have installed two physical machines with KVM virtualization using Red Hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 In h2 the virtual machines w2 , db1 and ids. ...
1
vote
2answers
37 views

Separate normal traffic [closed]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...