New answers tagged snort
After some debugging, I've found that the issue is due to the BASE caching code. It looks (among others) for '(spp_%' instead of 'spp_%', which is the correct start of the arpspoof preprocessor signature name. So i changed the part of the query that is created from line 234 in base_cache.inc.php: /* Preprocessor events only */ # The original "(sig_name ...
That looks to me like it would alert if it receives traffic from the defined external network ($EXTERNAL_NET) to your defined home network ($HOME_NET) where the TCP fin flag is set on it's own. This could be taken to indicate a piece of scanning software, as in a standard TCP communication FIN isn't sent on it's own, it goes along with an ACK flack (there's ...
No, Snort is not designed to log all application and events occurring in a system. A HIDS is not just a NIDS limited to just one host; it's a separate and additional layer of protections that can only be performed locally (like looking at files, processes, logs, and user contexts). Snort doesn't even try to do any of that.
Top 50 recent answers are included