I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok).

The goal is to set up some web interface providing a way to view the whole TCP stream packets of each Snort alert. I'm interested in outgoing packets only. Say, I have to prevent my server from replying with a string "root:x:0:0". So, I add a rule:

reject tcp any any -> any any (content:"root:x:0:0"; flow:to_client; msg:"attack1_to_client"; sid:31337)

and get my alerts logged. Alert log is growing fairly quicky. And I have to find all unique request strings leading to /etc/passwd disclosure, and block all such string.

closed as unclear what you're asking by Steffen Ullrich, Mark, schroeder, Eric G, Xander Apr 14 '15 at 0:07

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What was your question? – schroeder Apr 13 '15 at 21:46
  • The question: are there any projects available to achieve my goals? – Hidden Name Apr 14 '15 at 9:35

Browse other questions tagged or ask your own question.