New answers tagged snort
Look carefully at your content pattern, currently: content: "|0d 0a|"; content: "|0d 0a|"
This is probably a bad configured scanning(attempting) of the communications compagny in Portugal. Since the ip-range might be the same as yours. Or they misconfigured some other connection ip's. Nevertheless i don't think this commucation compagny is trying to hack you. Unless you have valuable information ;). Greets Samuel More info: inetnum: ...
For testing firewalls, I generate my own scripts using hping. One of the options is to fragment traffic (-f) and you can set the data size (-d).
Ok Break your Question with its solution into parts. PortScan There are some configurations that you need to change to enable nmap portscan open the snort configuration file with sudo gedit /etc/snort/snort.conf. uncomment and modify this line ( #428 usually ) : Portscan detection. For more information, see README.sfportscan preprocessor sfportscan: ...
Top 50 recent answers are included