Questions tagged [snort]
Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).
0
votes
0answers
32 views
How to determine TLS traffic in snort signature
I am trying to have a snort signature that can detect encrypted traffic but I am not able to determine the TLS traffic using a snort signature.
The content keyword search in the payload of the packet,...
0
votes
0answers
77 views
Snort rule to detect non-TLS traffic [closed]
I am having trouble creating a snort rule that will allow me to detect unencrypted traffic.
My goal is to detect any unencrypted traffic.
I was thinking to create a rule that if it doesn't match ...
0
votes
1answer
45 views
Are these snort alerts false positives or attacks?
Can anyone describe this alert please?
I am confused if an attack is run against my network or not.
I run snort IDS/IPS through a pfsense firewall.
0
votes
0answers
4 views
In Snort for Windows, how do I limit log file size, keep that file, and make another file instance
I have Snort for Windows.
I am trying to make a log file of say size limit 1MB.
When the log file hits the 1MB maximum, I want it to
close that file (snort.log.1234567890)
and open a new log file ...
0
votes
0answers
30 views
Snort CSV details @ alert
I have enabled the fast logging mode, my question here is how can I extract the CVE details or reference tag inside the /var/log/alert file, as if now I am able to see only this much data in alert ...
4
votes
3answers
2k views
Threshold for DDOS Attack
I am trying to understand and simulate SYN Flood DDOS attacks. I am using snort to give me alerts. While I have control over the rate for my testing, I am interested in knowing what a good estimate of ...
1
vote
1answer
178 views
How to sniff VPN traffic using Snort?
Here's what I want to do:
I want to use a VPN client on my PC (like TunnelBear).
Then I want to use Snort to sniff traffic before it's encrypted and after it's decrypted by VPN.
So basically I want ...
0
votes
1answer
120 views
Loopback with Suricata
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
116 views
Analyzing Apache log with Snort
I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
1
vote
0answers
75 views
Are these Snort rules correct?
I wrote this rule so that when there are more than three failed SSH connection attempts that there is an alert but it is not working. Are these rules badly written? Or if not I ask the exact writing ...
0
votes
0answers
120 views
snort rules are enabled by pulledpork but in the same time are skipped?
I am using pulledpork for management of rules. I had enabled rules from 1:1000 to 1:5735 those rules are enabled but in the same time are skipped.
As output I had:
https://github.com/shirkdog/...
1
vote
0answers
63 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
0answers
168 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
0
votes
0answers
26 views
0 dynamic rules read
I am running Snort as IDS in Security Onion and get this message: 0 Dynamic rules
All SO_RULES are loaded in snort.conf in the correct path.
25867 Snort rules read
23950 detection rules
...
4
votes
4answers
889 views
Benefit of using two network interfaces for intrusion detection system
What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
0
votes
2answers
211 views
how to write a snort rule to alert traffic that does not find any matched rules
Snort in IDS mode:
If there is some traffic that does NOT find any matched rule against all existing Snort rules, how would you write a bottom rule to alert this traffic?
1
vote
1answer
218 views
pcap files for simulated attacks on SCADA systems?
I need to get hold of some pcap files belonging to a simulated attack on SCADA systems. My goal is to then use Snort for the detection. Or if somebody can suggest a practical environment to create my ...
0
votes
0answers
312 views
Snort.log output as unreadable symbols
I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox.
After installing and successfully validating the configuration ...
1
vote
1answer
153 views
How do I map the information in snort u2spewfoo output to the rule which triggered the alert?
I have a snort log file in unified2 format and I am able to view the output using the u2spewfoo utility.
I think that I understand the generator id, signature id, and revision tell me why the alert ...
1
vote
2answers
458 views
Snort Exercises
I am beginning to study Snort rules and the teacher give to us the next exercises:
A server on which Snort is installed is monitoring all traffic on subnet 172.16.0.0 with mask 255.255.0.0. From now ...
0
votes
0answers
213 views
Snort pcap mapping with kibana
I am working on project which has four entities (snort,logstash,elasticsearch,kibana).I am maintaining snort which is deployed in Centos 7, snort puts a metadata in alert file(/var/log/alert) this ...
3
votes
0answers
72 views
snort add more data in alert file
I want to add more data to alert file rightnow the data what our analyst team see is very minimal and we are not giving access to them to our snort backend server, our design is like centos /var/log/...
0
votes
1answer
1k views
Snort priority range
What is the range of values for the 'priority' parameter in a Snort rule? The documentation it doesn't make it clear:
The priority tag assigns a severity level to rules. A classtype rule assigns a ...
2
votes
1answer
266 views
Security Onion VMWare + OpenWRT IPTables Mirroring
I'm trying to set up SO in my home network to lab and see if I can monitor all ingress/egress traffic from my SOHO router. I don't have a switch with SPAN ports, or a network tap so I'm using OpenWRT ...
3
votes
1answer
548 views
How to detect a string in HTML with Snort?
I am trying to detect a string in HTML (already unzipped) with Snort. I set this rule to find content 7038685658 in my Apache web server's HTML:
alert tcp any any <> any any (msg:"cell"; ...
1
vote
1answer
929 views
IDS Snort rule to catch Slow-Loris
I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -
alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, ...
0
votes
1answer
233 views
Suricata does not detect “self” traffic
I have built two simple rules
alert tcp any any -> any any (msg: "tcp detected"; sid: 2; rev: 1;)
alert udp any any -> any any (msg: "udp detected"; sid: 1; rev: 1;)
Then from the same machine ...
2
votes
2answers
190 views
Can dual NIC Snort machine cause threats to bypass firewall?
I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic.
Setup I am thinking about:
Snort computer with two NICs
One NIC connected to hub/tap outside firewall (...
0
votes
0answers
119 views
Using snortsam on preprocessor rules
I am using snortsam to block IP addresses. I can't use inline mode and nfqueue as it considerably decreases network traffic performance.
Currently I am trying to detect TCP protocol anomalies and ...
1
vote
0answers
113 views
snort file_inspect signature working inconsistently [closed]
I am trying snorts file inspect preprocessor for blocking incoming files from their sha256sums. I am using snort version 2.9.9.0 with daq nfq inline mode any my file_inspect preprocessor configs are ...
0
votes
1answer
274 views
Snort: Cannot decode data link type 127 reading a pcapng file
I've captured on my wifi some days ago and now I want snort to analyse the capture to detect any problem. However, when I run snort -l ./snort-log -b -c /etc/snort/snort.conf -r captura-analisar....
1
vote
2answers
164 views
How to detect long lived SSH sessioned
I am trying to figure out a way to detect ssh sessions that have been established over a long period of time. I seem to recall that there were ways to detect tcp connections that have been connected ...
1
vote
2answers
1k views
Major differences between Snort and Snort 3.0
When I visited the the Snort's website to download the source code for compilation, I found there were 2 downloads available.
One was titled Snort and another was titled Snort 3.0
Has the ...
1
vote
2answers
343 views
REJECT Nikto Scans With Snort Rules
Hoping someone on here knows a way to reject Nikto traffic with Snort rules. I've been having zero luck for days finding this anywhere online. Thanks. Peace.
0
votes
0answers
226 views
how to use snort to track http/https sessions separately?
how can I use snort to breakdown http/https traffic into separate sessions and track each session separately and also dump them into separate log files or something that I can read from.
3
votes
3answers
8k views
Can Snort run on a Raspberry Pi?
I am in the preliminary stages of designing a cybersecurity suite for my home network. I don't have any servers or anything, just the standard home setup (computers, tablets, game consoles). The ...
0
votes
1answer
251 views
Can I run Snort on a slow computer?
I'm trying to use a device with 1GB of RAM and a Single 800 MHz core CPU.
I will use Snort to analyze traffic on my LAN network. Snort, unfortunately, cannot analyze all the traffic (sometimes it ...
1
vote
0answers
86 views
Signature Generate by Honeyd “Honeycomb” is not accept by Snort IPS
I posted this on SO [https://stackoverflow.com/questions/44652014/signature-generate-by-honeyd-honeycomb-is-not-accept-by-snort-ips] is this on topic here? What would I need to do to my question ?
I ...
0
votes
1answer
406 views
Snort Alert - What is PROTO:255?
My Snort alert output is like below. The first element of 4th row of each alert indicates Protocol. However, in the alert (portscan) TCP Portscan, the protocol is PROTO:255. What does it mean?
Why ...
0
votes
0answers
394 views
Snort rules uricontent
I am experiencing trouble crating rules that would check user HTTP behaviour (page address, POST/GET params..).
alert tcp any any -> any any (msg:"Alfa in uri"; flow:to_server,established; ...
1
vote
0answers
235 views
Detecting Guest to Guest Traffic in Virtualbox Using Host Running Snort
Not sure if this is a simple question but I was hoping for some insight into finishing a pentest lab. My goal is to have Snort sniff an attack in a virtual environment between two guest VM's. My ...
1
vote
0answers
201 views
How to log only the TCP header using command line in snort or nmap? [closed]
I work with snort log file and now I need to extract the TCP header.
My question is: How to log only the TCP header from the packets captured by snort log file (without the payload) using command ...
1
vote
2answers
2k views
How does the flow option of Snort work?
For example, flow:established is detecting only for packets with sessions connected.
Then, the server is rejecting packets to received after the session is disconnected?
1
vote
1answer
515 views
Troubleshooting Snort Rules
I am trying to troubleshoot a bunch of flowbits generated by pulledpork from snortrules-snapshot-2990.tar.gz.
WARNING: flowbits key 'file.pdf' is set but not ever checked.
The line in the generated ...
1
vote
0answers
211 views
Snort generates an alert that is empty [closed]
I am working with commands that have already been tested to work but they aren't working now.
This is my config file:
alert tcp any any <> any any (msg: "/etc/passwd Payload Found"; content: "/...
4
votes
1answer
263 views
How to inspect TCP Header -> Optional Data with Snort?
I have been looking around for clues on how to define rules, decoders or preprocessors to be able to content-inspect the TCP Header's Optional Data ( The last 0-40 bytes of the TCP Header)
TCP ...
2
votes
1answer
413 views
Where can I find a snort signature for detecting slowhttp DoS attack from Slowloris tool [duplicate]
I am performing a test on some DoS attacks and how to detect them. I am currently testing the slowloris tool, but all the signature I have seen online, as very very few as they are,do not work even ...
1
vote
0answers
161 views
SourceFire/Snort/FirePower Custom Regex Rule Error
I am getting an unknown/extra pcre option encounterederror when trying to save my custom rule.
^([A-HK-PRSVWY][A-HJ-PR-Y])\s?([0][2-9]|[1-9][0-9])\s?[A-HJ-PR-Z]{3}$
The rule is to match UK Vehicle ...
2
votes
1answer
432 views
Use Snort to limit or prioritize application bandwidth usage [closed]
Short version of a long story, we've been using bluecoat packetshapers for bandwidth control on a multi-tenant network. We like it because it allows us to divide the bandwidth equally, but still allow ...
1
vote
0answers
99 views
Snort Rules Data Structure
the IDS programm Snort uses a linked list to organize rules (ORT/OTN). This list is used in run time. How it is possible to view this data structure in run time?
Any tip would be helpful. Thanks in ...
