Suppose i have not written rule for a type of attack in SNORT; It is obvious that it wont show any alerts. I wanna develop a system wherein i capture packets that SNORT allows n do further processing on those packets to detect if those belonged to an attack or not!

So, how to i log packets which snort considers to be genuine if no rules are written for that ?


You are approaching this the wrong way. A far better approach is to use a capture engine like Daemonlogger and then post-process the data in near real time.

The reason is that, as wonderful as Snort is, the more you add the the ruleset, the slower it will operate. Don't get me wrong, it's very good, but this is not an ideal way to configure it. If you are dealing with high speed well utilized links, Snort may begin to drop packets.

Marty Roesch, created of Snort, wrote Daemonlogger to address exactly this issue. Daemonlogger is used for fast full packet capture, which is then analyzed by one or more Snort instances (or other tools like SANCP, Silk, etc.)

Rather than starting from scratch I'd suggest that you look into SecurityOnion, which has all of this stuff already installed and ready to use, or look at NSMWiki.org, which has great general information and lots of specific information on Sguil, which is an excellent NSM architecture and interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.