1

I posted this on SO [https://stackoverflow.com/questions/44652014/signature-generate-by-honeyd-honeycomb-is-not-accept-by-snort-ips] is this on topic here? What would I need to do to my question ?

I am doing a project which need to use "Honeyd" and "Honeycomb" plugin in pcA. So pcB will act as an attacker to attack the honeypot and Honeycomb will generate the Snort rule for snort help to block the same attack. However, currently after I put the signature that generate by Honeycomb to Snort I not able to run Snort as screen shot below screenshot problem to launch Snort

Below is the signature generate by Honeycomb

Signature report at Wed Jun 7 17:40:37 2017

alert tcp 0.0.0.0/8 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h40m36 2017 "; ip_proto: "ip"; flags: FSRPAU!; flow: stateless; )

Signature report at Wed Jun 7 17:44:47 2017

alert tcp 0.0.0.0/8 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h40m36 2017 "; ip_proto: "ip"; flags: FSRPAU!; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "ip"; flags: F+; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "ip"; flags: FP; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "19"; flags: FP; ack: 2417186313; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "19"; flags: F+; ack: 2417186313; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "ip"; flags: FSRPAU!; flow: stateless; )

Signature report at Wed Jun 7 17:45:57 2017

alert tcp 0.0.0.0/8 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h40m36 2017 "; ip_proto: "ip"; flags: FSRPAU!; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "ip"; flags: F+; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "ip"; flags: FP; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "19"; flags: FP; ack: 2417186313; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "19"; flags: F+; ack: 2417186313; flow: stateless; ) alert tcp any 0 -> any 0 (msg: "Honeycomb Wed Jun 7 17h44m45 2017 "; ip_proto: "ip"; flags: FSRPAU!; flow: stateless; )

  • You are essentially trying to use rules generated by software which got no updates for 10 years (honeyd, honeycomb) against actively maintained software with regular releases and which got lots of changes in the last 10 years (snort). Thus, it is not really a surprise that it does not work. Try running the rules with a release of snort from 10 years ago instead. – Steffen Ullrich Jun 20 '17 at 17:27
  • Thanks you for your suggestion . Its true I never think about this. – dmxxiang Jun 21 '17 at 4:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.