What are the main classification of attacks in network and specially in Snort IDS?! Is it possible to power up the Snort by classifying the attack into for 5 main groups, for example; R2L, U2R etc. What snort does in detecting the attack?


All snort rules are categorised. Please see here - http://blog.snort.org/2012/03/rule-category-reorganization.html.

  • Yeah, for sure!! I just read it before, but i want to know these categories for some attacks like U2R, R2L, spoofing and etc. And also the old categories will be changed to protocols and files based!! but my question is that, Is there any category behind these categories for famous attacks or not?!! – Mohsen Gh. May 16 '12 at 18:25
  • So by U2R you're looking for privilege escalation type attacks, well they're system/application specific depending if either has a vulnerability and R2L equates to some sort of vulnerability that can be exploited to obtain local access via a remote exploit (I wouldn't call them famous). They're generic descriptions and you'll see Snort is (and will be) categorised based on protocol (vulnerabilities), types of client-side attacks (based on file types), policy or indicators (e.g. compromise). This evolution of categories will continue for quite a while from what I can see. – Mark Hillick May 16 '12 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.