Questions tagged [snort]
Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).
192
questions
0
votes
0answers
29 views
sfportscan ignore_scanned option [closed]
I am trying to ignore a IP/port for sfportscan. I have tried adding the host this way:
[IP] [port] and [IP]:[port]
But I get this error message:
Invalid ip_list to 'ignore_scanned' option
1
vote
0answers
62 views
Snort Content first 3 bytes the same then create an alert [closed]
I was wondering if you could add into a snort rule the ability to only alert if the first 3 bytes match. I think I need to edit the content in my current rule content:"|37 e1 a4|"; I can add the full ...
0
votes
0answers
20 views
Snort stops generating alerts when HOME_NET changed to public addresses
I have used snort for traffic analysis quite often and it worked fine as it generates rules that are corresponding to packets doing malicious activities on my HOME_NET which is always private ...
0
votes
1answer
185 views
How to create content rule in Snort
The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual ...
0
votes
0answers
73 views
error read-file in snort when reading back pcap file
I get this error when using snort -r to read a saved pcap file and apply snort rules on it.
ERROR : pfring daq does not support read-file
I am running snort in Security Onion
I tried many things:
...
-1
votes
1answer
140 views
Explain this snort rule [closed]
Please explain the following Snort rule. Describe the meanings of all the options and modifiers used in the rule
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"Attack Detected"; flow:...
0
votes
0answers
38 views
Snort rules to detect metasploit's trojan [duplicate]
I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ...
Does anyone know snort rules in order to detect this? Despite my research, I found ...
0
votes
0answers
42 views
Detect repeating bits with snort
I am new to snort and I am trying to make a rule that will detect repeating bits in a packet. I set it to offset to the 100th bit and the depth is 105 bits. The problem I am having is I can't figure ...
0
votes
1answer
328 views
Can Snort inline/blocking mode block traffic from one host to another on internal LAN?
I'm putting Snort on a wifi router. My understanding is when in inline/blocking mode, I have to bridge a LAN interface to the WAN interface for packet inspection. If this is the case, it does not seem ...
1
vote
0answers
160 views
Stateful detection in Snort
From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules.
What if I wish to have a rule based on multiple packets such as analysis of a ...
0
votes
0answers
133 views
Snort Rule to check for TCP options
Lets say malformed packets are sent by attacker with improper TCP options length i.e, 50bytes,222bytes etc.
Is there any way to monitor these packets having invalid tcp options set using Snort or ...
2
votes
1answer
52 views
Confusion Matrix for Generated Signatures in Snort
How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
0
votes
0answers
90 views
What can be wrong with this simple Snort Rule?
i'm using snort since some weeks now and today i want to use it in order to trigger alert for some content in the case of HTTP requests.
So i try a simple rule like this one in order to begin..
alert ...
1
vote
0answers
236 views
OpenAppID with Snort on pfSense [closed]
I'm using OpenAppID with Snort on pfSense, it actually work but when I view some script detector, it just detect by http pattern, which I can replace by using snort rule (with "content" option). So ...
0
votes
1answer
2k views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
1
vote
2answers
368 views
How to analyze .pcap file to write a generic snort rule to detect c&c activity
I am diving into snort and trying to figure out what everything does but I'm having a little trouble. I have a .pcap file I want to analyse and I know there is malicious c&c traffic on it. (...
2
votes
1answer
161 views
Is there a way to change the format of the output from snort?
I'm pretty new to snort and don't know too much about it. I am trying to put together a report of my snort files but, I only want the connections not the entire flows. For example, say I have a few ...
1
vote
2answers
3k views
Create a snort rule that will alert on traffic on ports 443 & 447
Using the learning platform, the subject is snort rules.
Question is:
Create a snort rule that will alert on traffic with destination ports
443 and 447.
My attempts:
alert tcp any any -> ...
0
votes
0answers
471 views
How to determine TLS traffic in snort signature
I am trying to have a snort signature that can detect encrypted traffic but I am not able to determine the TLS traffic using a snort signature.
The content keyword search in the payload of the packet,...
0
votes
1answer
356 views
Are these snort alerts false positives or attacks?
Can anyone describe this alert please?
I am confused if an attack is run against my network or not.
I run snort IDS/IPS through a pfsense firewall.
0
votes
1answer
117 views
In Snort for Windows, how do I limit log file size, keep that file, and make another file instance
I have Snort for Windows.
I am trying to make a log file of say size limit 1MB.
When the log file hits the 1MB maximum, I want it to
close that file (snort.log.1234567890)
and open a new log file ...
4
votes
3answers
3k views
Threshold for DDOS Attack
I am trying to understand and simulate SYN Flood DDOS attacks. I am using snort to give me alerts. While I have control over the rate for my testing, I am interested in knowing what a good estimate of ...
1
vote
1answer
614 views
How to sniff VPN traffic using Snort?
Here's what I want to do:
I want to use a VPN client on my PC (like TunnelBear).
Then I want to use Snort to sniff traffic before it's encrypted and after it's decrypted by VPN.
So basically I want ...
0
votes
1answer
402 views
Loopback with Suricata
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
451 views
Analyzing Apache log with Snort
I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
1
vote
0answers
266 views
Are these Snort rules correct?
I wrote this rule so that when there are more than three failed SSH connection attempts that there is an alert but it is not working. Are these rules badly written? Or if not I ask the exact writing ...
1
vote
0answers
163 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
3
votes
0answers
466 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
5
votes
4answers
1k views
Benefit of using two network interfaces for intrusion detection system
What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
0
votes
2answers
643 views
how to write a snort rule to alert traffic that does not find any matched rules
Snort in IDS mode:
If there is some traffic that does NOT find any matched rule against all existing Snort rules, how would you write a bottom rule to alert this traffic?
1
vote
1answer
514 views
pcap files for simulated attacks on SCADA systems?
I need to get hold of some pcap files belonging to a simulated attack on SCADA systems. My goal is to then use Snort for the detection. Or if somebody can suggest a practical environment to create my ...
0
votes
0answers
678 views
Snort.log output as unreadable symbols
I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox.
After installing and successfully validating the configuration ...
1
vote
1answer
333 views
How do I map the information in snort u2spewfoo output to the rule which triggered the alert?
I have a snort log file in unified2 format and I am able to view the output using the u2spewfoo utility.
I think that I understand the generator id, signature id, and revision tell me why the alert ...
1
vote
2answers
1k views
Snort Exercises
I am beginning to study Snort rules and the teacher give to us the next exercises:
A server on which Snort is installed is monitoring all traffic on subnet 172.16.0.0 with mask 255.255.0.0. From now ...
3
votes
0answers
149 views
snort add more data in alert file
I want to add more data to alert file rightnow the data what our analyst team see is very minimal and we are not giving access to them to our snort backend server, our design is like centos /var/log/...
0
votes
1answer
3k views
Snort priority range
What is the range of values for the 'priority' parameter in a Snort rule? The documentation it doesn't make it clear:
The priority tag assigns a severity level to rules. A classtype rule assigns a ...
2
votes
1answer
444 views
Security Onion VMWare + OpenWRT IPTables Mirroring
I'm trying to set up SO in my home network to lab and see if I can monitor all ingress/egress traffic from my SOHO router. I don't have a switch with SPAN ports, or a network tap so I'm using OpenWRT ...
3
votes
1answer
2k views
How to detect a string in HTML with Snort?
I am trying to detect a string in HTML (already unzipped) with Snort. I set this rule to find content 7038685658 in my Apache web server's HTML:
alert tcp any any <> any any (msg:"cell"; ...
1
vote
1answer
2k views
IDS Snort rule to catch Slow-Loris
I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -
alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, ...
0
votes
1answer
525 views
Suricata does not detect “self” traffic
I have built two simple rules
alert tcp any any -> any any (msg: "tcp detected"; sid: 2; rev: 1;)
alert udp any any -> any any (msg: "udp detected"; sid: 1; rev: 1;)
Then from the same machine ...
2
votes
2answers
301 views
Can dual NIC Snort machine cause threats to bypass firewall?
I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic.
Setup I am thinking about:
Snort computer with two NICs
One NIC connected to hub/tap outside firewall (...
1
vote
0answers
139 views
snort file_inspect signature working inconsistently [closed]
I am trying snorts file inspect preprocessor for blocking incoming files from their sha256sums. I am using snort version 2.9.9.0 with daq nfq inline mode any my file_inspect preprocessor configs are ...
0
votes
1answer
576 views
Snort: Cannot decode data link type 127 reading a pcapng file
I've captured on my wifi some days ago and now I want snort to analyse the capture to detect any problem. However, when I run snort -l ./snort-log -b -c /etc/snort/snort.conf -r captura-analisar....
1
vote
2answers
192 views
How to detect long lived SSH sessioned
I am trying to figure out a way to detect ssh sessions that have been established over a long period of time. I seem to recall that there were ways to detect tcp connections that have been connected ...
1
vote
2answers
2k views
Major differences between Snort and Snort 3.0
When I visited the the Snort's website to download the source code for compilation, I found there were 2 downloads available.
One was titled Snort and another was titled Snort 3.0
Has the ...
1
vote
2answers
595 views
REJECT Nikto Scans With Snort Rules
Hoping someone on here knows a way to reject Nikto traffic with Snort rules. I've been having zero luck for days finding this anywhere online. Thanks. Peace.
0
votes
0answers
340 views
how to use snort to track http/https sessions separately?
how can I use snort to breakdown http/https traffic into separate sessions and track each session separately and also dump them into separate log files or something that I can read from.
3
votes
3answers
14k views
Can Snort run on a Raspberry Pi?
I am in the preliminary stages of designing a cybersecurity suite for my home network. I don't have any servers or anything, just the standard home setup (computers, tablets, game consoles). The ...
0
votes
1answer
371 views
Can I run Snort on a slow computer?
I'm trying to use a device with 1GB of RAM and a Single 800 MHz core CPU.
I will use Snort to analyze traffic on my LAN network. Snort, unfortunately, cannot analyze all the traffic (sometimes it ...
1
vote
0answers
125 views
Signature Generate by Honeyd “Honeycomb” is not accept by Snort IPS
I posted this on SO [https://stackoverflow.com/questions/44652014/signature-generate-by-honeyd-honeycomb-is-not-accept-by-snort-ips] is this on topic here? What would I need to do to my question ?
I ...
