Questions tagged [snort]

Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

Filter by
Sorted by
Tagged with
0 votes
0 answers
66 views

Snort content syntax

Is it possible to use the symbols <, /, >, space, in the content option of a Snort rule? Or should I use URL encoding instead? Which syntax is correct? content:"%3Cscript%20" content:&...
S_I's user avatar
  • 1
0 votes
0 answers
89 views

Snort fails when run as a service

I've got Snort compiled, configured, and running. Only problem I have is that it fails when I try to run it as a service. I've mainly been using the guide from here: https://snort-org-site.s3....
David Stringham's user avatar
0 votes
1 answer
143 views

Snort rule doesn't match the content in Meterpreter session packet

I'm working on a university project and I'm trying to identify a reverse shell attack with Snort IDS. For the attack I used Meterpreter/reverse_tcp and analyzed the packets via Wireshark for traces to ...
Mattia cavaliere's user avatar
0 votes
0 answers
62 views

Is it possible to count SYN and ACK flags separately in a single rule in Snort?

I want to write a rule for Snort to detect lost traffic in the network. Is it possible to write a rule that, by combining two flags, SYN and ACK, it declares that if the number of SYNs to the server ...
user16385455's user avatar
1 vote
1 answer
135 views

Snort / Suricata rules from HOME_NET with rule option flow:to_client

Reading through Suricata/Snort IDS rules, I can see examples such as below, and scratching my head to understand how is it feasible that a connection from home_network to external_network can have a ...
RGC's user avatar
  • 11
0 votes
1 answer
287 views

Difference between to_server and from_client in snort

I am trying to wrap my head around the difference between the different flow options in Snort. There are four directional flow options: Option Description 1) to_client Trigger on server ...
Deepak's user avatar
  • 103
0 votes
0 answers
1k views

How to create a snort rule to detect a certain HTTP status code

I am trying to use snort to detect unauthorized HTTP access (wrong credentials or a HTTP status 401 code) by creating snort rules, I tried different combinations of snort options, but none of them ...
Sarah Abdulrezzak's user avatar
2 votes
1 answer
398 views

What is the best way to create a PCAP file containing malicious traffic?

I'm in my last year of university and for my honour's project I am tasked with comparing two intrusion detection systems, snort and suricata, hosted on a virtual machine on my PC. As I have no access ...
Conor's user avatar
  • 21
0 votes
0 answers
491 views

How to determine Snort rules source & destination IP and port

How do you figure out Snort's source & destination IP and port if the question is so vague? For example: Write a snort rule that detects a UK NI number sent from a client's web browser to a web ...
Elaine's user avatar
  • 1
0 votes
0 answers
2k views

Decrypt mobile phone app TLS/SSL traffic using Wireshark and Fiddler/Charles/MITM Proxy

I currently use fiddler/Charles Proxy/MITM proxy to decrypt and analyze SSL/TLS traffic from suspect mobile apps I want to analyze. The process I follow is to export a CA cert from Fiddler, then ...
IM3CPO's user avatar
  • 1
0 votes
0 answers
37 views

How to configure Snort 3 to detect nmap's port scanning? [duplicate]

How to configure snort 3 to detect nmap's port scanning? For instance I want to know that an external machine A is looking with nmap for open ports on my machine B. Such a port scan can include all ...
Dawid's user avatar
  • 101
0 votes
0 answers
791 views

Use sfportscan preprocessor in snort 3

I have not found anywhere how to configure and use sfportscan in snort 3; all documentation I can find is for snort 2. I am aware of this answer, which applies to snort 2.9, and I don't think it helps ...
mneumann's user avatar
  • 101
1 vote
1 answer
496 views

Can an Intrusion Prevention System (e.g. Snort) prevent CSRF and XSS attacks?

I am currently learning about IPS and was wondering about a query that applies to how IPS works. I have knowledge of CSRF and XSS attacks, however I am unsure if Intrusion Prevention Systems can ...
dwayne_d11's user avatar
0 votes
0 answers
385 views

Snort does not detect attacks when running in offline mode

When I run Snort on a pcap file (that contains malicious traffic), it does not detect anything. I uncommented the rules path in Step #7 at snort.conf. Nothing is changed. How to let Snort detect ...
Mimi's user avatar
  • 1
1 vote
0 answers
2k views

Snort DNS rule immersive labs [closed]

The question is "Create a rule to detect DNS requests to 'interbanx', then test the rule with the scanner and submit the token." My rule is: alert udp any any -> any 53 (msg:"alert&...
Aud Cryan's user avatar
1 vote
1 answer
2k views

SNORT rule for detecting/preventing unauthorized VPN or encrypted traffic

Here's my not so theoretical scenario: A day-one Trojan horse attack where the attacker sets up a secure connection back to himself using a well known trusted port, such as 80 21 443. Or for instance, ...
TaranYourAss's user avatar
1 vote
0 answers
212 views

Can I use Snort to detect multiple VLANs over site to site VPN?

I am studying options to check traffic over multiple VLANs using a Snort cloud machine, since the normal Snort installation requires to get local network and local VLAN information. I thought to use ...
Ahmad Abuhasna's user avatar
1 vote
0 answers
2k views

Blocking FTP Brute Force Attack with Snort

I am trying to become familiar with Snort, and for this reason, I have set three VMs. A Kali, a windows machine with XAMPP and Ubuntu where I installed Snort. I believe I have Snort running in ...
george's user avatar
  • 11
1 vote
0 answers
230 views

Snort doesn't capture raw packets

I have a python code on Linux to create a raw packet: import socket s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP) s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1) ...
Meysam's user avatar
  • 113
2 votes
1 answer
2k views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
TheSoulkiller's user avatar
0 votes
0 answers
242 views

need help using PCRE in snort

Can someone guide me how to write PCRE option to match list of websites such as for eg facebook.com, google.com,ebay.com? I tried to understand from manual but couldn't get is right? regards,
bura's user avatar
  • 1
0 votes
1 answer
834 views

Using dsize:<500 parameter in snort

I am trying to make a rule to alert when downloading a .jpg file less than certain size. I used the parameter dsize:<500. But it is not alerting when I tried to run a .pcap file containing a jpg ...
bura's user avatar
  • 1
-1 votes
1 answer
217 views

Snort automatic protocol detection

Does Snort have the "automatic protocol detection" function like Suricata? I read that Snort 3 has "Autodetect services for portless configuration" feature. Does it mean that this ...
ustavsaat's user avatar
1 vote
2 answers
7k views

Difference between Zeek (Bro) and Snort 3

I'm trying to find difference between Zeek and Snort 3. Сan anybody tell me what are the advantages of Zeek against Snort 3?
ustavsaat's user avatar
0 votes
1 answer
880 views

ids - How do I match any string in a list of snort contents?

If I do something like alert tcp any any <> any any (content:"TestA"; content:"TestB"; sid:1000000; msg:"Syntax correct!";) then the syntax is correct, but, what I would like to do is to ...
Salviati's user avatar
  • 101
1 vote
0 answers
449 views

Snort Content first 3 bytes the same then create an alert [closed]

I was wondering if you could add into a snort rule the ability to only alert if the first 3 bytes match. I think I need to edit the content in my current rule content:"|37 e1 a4|"; I can add the full ...
Daniel Birdsall's user avatar
0 votes
1 answer
3k views

How to create content rule in Snort

The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual ...
kgkmeekg's user avatar
  • 113
0 votes
0 answers
388 views

error read-file in snort when reading back pcap file

I get this error when using snort -r to read a saved pcap file and apply snort rules on it. ERROR : pfring daq does not support read-file I am running snort in Security Onion I tried many things: ...
OSAMA's user avatar
  • 1
-1 votes
1 answer
993 views

Explain this snort rule [closed]

Please explain the following Snort rule. Describe the meanings of all the options and modifiers used in the rule alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"Attack Detected"; flow:...
penceyreject's user avatar
1 vote
0 answers
274 views

Snort rules to detect metasploit's trojan [duplicate]

I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ... Does anyone know snort rules in order to detect this? Despite my research, I found ...
Jérémy Papin's user avatar
0 votes
1 answer
1k views

Can Snort inline/blocking mode block traffic from one host to another on internal LAN?

I'm putting Snort on a wifi router. My understanding is when in inline/blocking mode, I have to bridge a LAN interface to the WAN interface for packet inspection. If this is the case, it does not seem ...
Bryan's user avatar
  • 3
3 votes
0 answers
618 views

Stateful detection in Snort

From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules. What if I wish to have a rule based on multiple packets such as analysis of a ...
Rajiv's user avatar
  • 49
2 votes
1 answer
149 views

Confusion Matrix for Generated Signatures in Snort

How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
Tasneem Singh's user avatar
1 vote
0 answers
491 views

OpenAppID with Snort on pfSense [closed]

I'm using OpenAppID with Snort on pfSense, it actually work but when I view some script detector, it just detect by http pattern, which I can replace by using snort rule (with "content" option). So ...
Andy's user avatar
  • 11
0 votes
1 answer
6k views

Snort rule for syn flood attacks - Limiting number of alerts

So I have a snort rule that detects syn flood attacks that looks like this: alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S; flow: stateless; detection_filter: track by_dst, ...
Liam's user avatar
  • 1
1 vote
2 answers
2k views

How to analyze .pcap file to write a generic snort rule to detect c&c activity

I am diving into snort and trying to figure out what everything does but I'm having a little trouble. I have a .pcap file I want to analyse and I know there is malicious c&c traffic on it. (...
Dtb49's user avatar
  • 153
2 votes
1 answer
1k views

Is there a way to change the format of the output from snort?

I'm pretty new to snort and don't know too much about it. I am trying to put together a report of my snort files but, I only want the connections not the entire flows. For example, say I have a few ...
Dtb49's user avatar
  • 153
0 votes
3 answers
16k views

Create a snort rule that will alert on traffic on ports 443 & 447

Using the learning platform, the subject is Snort rules. Question is: Create a snort rule that will alert on traffic with destination ports 443 and 447. My attempts: alert tcp any any -> any 443 ...
mkh82's user avatar
  • 19
1 vote
0 answers
2k views

How to determine TLS traffic in snort signature

I am trying to have a snort signature that can detect encrypted traffic but I am not able to determine the TLS traffic using a snort signature. The content keyword search in the payload of the packet,...
rekoo's user avatar
  • 11
0 votes
1 answer
500 views

In Snort for Windows, how do I limit log file size, keep that file, and make another file instance

I have Snort for Windows. I am trying to make a log file of say size limit 1MB. When the log file hits the 1MB maximum, I want it to close that file (snort.log.1234567890) and open a new log file ...
user194960's user avatar
4 votes
3 answers
4k views

Threshold for DDOS Attack

I am trying to understand and simulate SYN Flood DDOS attacks. I am using snort to give me alerts. While I have control over the rate for my testing, I am interested in knowing what a good estimate of ...
cosmicrao's user avatar
2 votes
1 answer
2k views

How to sniff VPN traffic using Snort?

Here's what I want to do: I want to use a VPN client on my PC (like TunnelBear). Then I want to use Snort to sniff traffic before it's encrypted and after it's decrypted by VPN. So basically I want ...
marmita's user avatar
  • 21
0 votes
1 answer
1k views

Loopback with Suricata

Is there any way of analyzing loopback traffic with Suricata? I am trying it this way without success: root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
Neveralways's user avatar
0 votes
1 answer
1k views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
Neveralways's user avatar
1 vote
0 answers
1k views

Are these Snort rules correct?

I wrote this rule so that when there are more than three failed SSH connection attempts that there is an alert but it is not working. Are these rules badly written? Or if not I ask the exact writing ...
Michel Tangue's user avatar
1 vote
0 answers
331 views

Snort not working with IDSWakeup

I have setup Snort with the registered user rules installed. I tested first by making the following rule in local.rules: alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
Daniel Lawton's user avatar
4 votes
0 answers
1k views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...
MikeSchem's user avatar
  • 2,361
5 votes
4 answers
2k views

Benefit of using two network interfaces for intrusion detection system

What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
synthesis's user avatar
  • 155
1 vote
2 answers
1k views

how to write a snort rule to alert traffic that does not find any matched rules

Snort in IDS mode: If there is some traffic that does NOT find any matched rule against all existing Snort rules, how would you write a bottom rule to alert this traffic?
TJCLK's user avatar
  • 838
1 vote
1 answer
1k views

pcap files for simulated attacks on SCADA systems?

I need to get hold of some pcap files belonging to a simulated attack on SCADA systems. My goal is to then use Snort for the detection. Or if somebody can suggest a practical environment to create my ...
SinT's user avatar
  • 13

1
2 3 4 5