Tag Info

New answers tagged


You can try Aide (OSS) that is an Advanced Intrusion Detection Environment and these are its features: supported message digest algorithms: md5, sha1, rmd160, tiger, crc32, sha256, sha512, whirlpool (additionally with libmhash: gost, haval, crc32b) supported file attributes: File type, Permissions, Inode, Uid, Gid, Link name, Size, Block count, ...


I would guess that this is an automated attack which does not have too much intelligence built-in. A sign of an automated script would be other (possibly unrelated) attempts from the same IP.


Script kiddies need holidays too. Seriously, how about the answer "coincidence"? If there are usually one or two per day, it´s not that hard to believe that some days have 0. Just random background noise in the internet. Or maybe there was a single person repeatedly trying to get into your net. In this case, things happen to people. Computer broke; ...


Whats the difference between IDS and NIDS? The concept of IDS can be divided to Two classes, this are Host IDS and Network IDS or HIDS and NIDS. IDS / \ HIDS NIDS Host IDS Network IDS Inspecting Host Inspecting Network For ...


If you want something that provides advice targeted to your specific needs and environment, then a free Snort or Suricata install without a support contract from an established vendor or good consultant is probably not the best solution for your desires, though it may fit your budget. In general, start off with the default SNORT rulesets you use - the ...


Typically, each rule includes a reference to the problem. In your specific case, the rule directly states: reference:url,blogs.technet.com/b/mmpc/archive/2013/05/10/browser-extension-hijacks-facebook-profiles.aspx This line is directly in the rule itself and serves as the explanation. The rule exists to alert you to suspicious traffic. You need to ...


Not sure how helpful this is but have you tried <?php as your content rather. [Untested] I've only personally setup TCP DDoS blocks using snort+snortsam for uni project. Also check you have defined correct NIC in conf file. Hope someone can give you a more direct answer.


Power friendly and powerful are hard to come by in cheap packages. It really depends on traffic workload. You may easily get away with some high end router (say ~$100) with OpenWRT. Check OpenWRT page for what models are supported. Get one with USB if you want to store more data on board or have a NAS handy. The other option has already been mentioned - ...


You might want to check for Endian firewall community version, which as know is free and can be run in virtual machine.

Top 50 recent answers are included