Questions tagged [snort]

Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

Filter by
Sorted by
Tagged with
1
vote
1answer
437 views

How to sniff VPN traffic using Snort?

Here's what I want to do: I want to use a VPN client on my PC (like TunnelBear). Then I want to use Snort to sniff traffic before it's encrypted and after it's decrypted by VPN. So basically I want ...
-1
votes
2answers
1k views

Create a snort rule that will alert on traffic on ports 443 & 447

Using the Immersivelabs learning platform, the subject is snort rules. Question is: Create a snort rule that will alert on traffic with destination ports 443 and 447. My attempts: alert tcp ...
0
votes
1answer
797 views

Snort rule for syn flood attacks - Limiting number of alerts

So I have a snort rule that detects syn flood attacks that looks like this: alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S; flow: stateless; detection_filter: track by_dst, ...
0
votes
0answers
22 views

Snort rules to detect metasploit's trojan [duplicate]

I'm currently working on Snort and I'm trying to detect meterpreter sessions in reverse TCP or HTTPS, a Trojan ... Does anyone know snort rules in order to detect this? Despite my research, I found ...
0
votes
1answer
62 views

In Snort for Windows, how do I limit log file size, keep that file, and make another file instance

I have Snort for Windows. I am trying to make a log file of say size limit 1MB. When the log file hits the 1MB maximum, I want it to close that file (snort.log.1234567890) and open a new log file ...
1
vote
1answer
412 views

Snort false positive, yet suspicious

I have Snort installed and tuned nicely with ET Rules on my pfSense, both my pfSense and the modem are using Googles public DNS 8.8.8.8. Recently I was denied access to google.com, and by reviewing ...
0
votes
0answers
32 views

Detect repeating bits with snort

I am new to snort and I am trying to make a rule that will detect repeating bits in a packet. I set it to offset to the 100th bit and the depth is 105 bits. The problem I am having is I can't figure ...
0
votes
1answer
61 views

Can Snort inline/blocking mode block traffic from one host to another on internal LAN?

I'm putting Snort on a wifi router. My understanding is when in inline/blocking mode, I have to bridge a LAN interface to the WAN interface for packet inspection. If this is the case, it does not seem ...
0
votes
1answer
205 views

Are these snort alerts false positives or attacks?

Can anyone describe this alert please? I am confused if an attack is run against my network or not. I run snort IDS/IPS through a pfsense firewall.
1
vote
0answers
83 views

Stateful detection in Snort

From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules. What if I wish to have a rule based on multiple packets such as analysis of a ...
2
votes
2answers
248 views

Can dual NIC Snort machine cause threats to bypass firewall?

I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic. Setup I am thinking about: Snort computer with two NICs One NIC connected to hub/tap outside firewall (...
0
votes
0answers
52 views

Snort Rule to check for TCP options

Lets say malformed packets are sent by attacker with improper TCP options length i.e, 50bytes,222bytes etc. Is there any way to monitor these packets having invalid tcp options set using Snort or ...
0
votes
1answer
864 views

Question on SNORT Rule

I am new to SNORT and can not figure out what the following rule means: alert tcp $EXTERNAL_NET any-> $HOME_NET any (msg:"SCAN FIN"; flags: F; reference:arachnids,27;
2
votes
1answer
38 views

Confusion Matrix for Generated Signatures in Snort

How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
0
votes
0answers
56 views

What can be wrong with this simple Snort Rule?

i'm using snort since some weeks now and today i want to use it in order to trigger alert for some content in the case of HTTP requests. So i try a simple rule like this one in order to begin.. alert ...
5
votes
2answers
4k views

How can I read snort logs in NIDS mode?

I am reading some snort logs from a firewall, I could read some with "snort -r file" But when I had tried the newest logs I get this error: snort -r snort.log Running in packet dump mode -...
1
vote
1answer
99 views

Is there a way to change the format of the output from snort?

I'm pretty new to snort and don't know too much about it. I am trying to put together a report of my snort files but, I only want the connections not the entire flows. For example, say I have a few ...
13
votes
5answers
59k views

Testing Snort IDS installation

What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work? alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
1
vote
0answers
121 views

OpenAppID with Snort on pfSense [closed]

I'm using OpenAppID with Snort on pfSense, it actually work but when I view some script detector, it just detect by http pattern, which I can replace by using snort rule (with "content" option). So ...
1
vote
0answers
319 views

Detecting Guest to Guest Traffic in Virtualbox Using Host Running Snort

Not sure if this is a simple question but I was hoping for some insight into finishing a pentest lab. My goal is to have Snort sniff an attack in a virtual environment between two guest VM's. My ...
0
votes
0answers
38 views

How to run a snort rule over PCAP file in Windows? [duplicate]

I have a PCAP file from CICIDS, and what I'd like to know is how can I apply the Snortrule in Windows? I've not written any custom rules myself but want to run the rules already available. For now, ...
1
vote
2answers
150 views

How to analyze .pcap file to write a generic snort rule to detect c&c activity

I am diving into snort and trying to figure out what everything does but I'm having a little trouble. I have a .pcap file I want to analyse and I know there is malicious c&c traffic on it. (...
0
votes
0answers
39 views

Can an IDS be used for detecting frames (not packets) from an non-authenticated station

Can an IDS, like snort, be used to detect Layer 2 network frames from a system i.e a system is trying to send a frame to the AP and whether Snort can work on the frame based on the rules?
0
votes
0answers
261 views

How to determine TLS traffic in snort signature

I am trying to have a snort signature that can detect encrypted traffic but I am not able to determine the TLS traffic using a snort signature. The content keyword search in the payload of the packet,...
3
votes
3answers
11k views

Can Snort run on a Raspberry Pi?

I am in the preliminary stages of designing a cybersecurity suite for my home network. I don't have any servers or anything, just the standard home setup (computers, tablets, game consoles). The ...
0
votes
0answers
58 views

Snort CSV details @ alert

I have enabled the fast logging mode, my question here is how can I extract the CVE details or reference tag inside the /var/log/alert file, as if now I am able to see only this much data in alert ...
1
vote
0answers
2k views

Snort gives “could not create the registry key” error for multiple kinds of operations

I've set up a host-only network in Virtualbox consisting of a Kali linux machine and a Windows 7 machine (the host is running OS X). I have Snort installed on Windows 7 and am attempting to verify ...
4
votes
3answers
2k views

Threshold for DDOS Attack

I am trying to understand and simulate SYN Flood DDOS attacks. I am using snort to give me alerts. While I have control over the rate for my testing, I am interested in knowing what a good estimate of ...
0
votes
1answer
441 views

Snort: Cannot decode data link type 127 reading a pcapng file

I've captured on my wifi some days ago and now I want snort to analyse the capture to detect any problem. However, when I run snort -l ./snort-log -b -c /etc/snort/snort.conf -r captura-analisar....
0
votes
1answer
257 views

Loopback with Suricata

Is there any way of analyzing loopback traffic with Suricata? I am trying it this way without success: root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
306 views

Analyzing Apache log with Snort

I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests ...
1
vote
0answers
154 views

Are these Snort rules correct?

I wrote this rule so that when there are more than three failed SSH connection attempts that there is an alert but it is not working. Are these rules badly written? Or if not I ask the exact writing ...
4
votes
0answers
797 views

Security Onion: Snorby alerts show all local network source IP (public and private)

I have recently installed the Security Onion distro for Ubuntu. This distro does a great job of combining multiple tools like snort/suricata, sguil, snorby, elsa, bro ids, squert, etc. Within my ...
2
votes
0answers
278 views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...
2
votes
1answer
1k views

Snort rule does not work when combining “content” fields

I'm trying to write a snort rule which outputs an alert whenever a web server returns an HTML document containing a specific string. I've come up with the following rule: alert tcp any any -> any ...
1
vote
0answers
128 views

Snort not working with IDSWakeup

I have setup Snort with the registered user rules installed. I tested first by making the following rule in local.rules: alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
4
votes
4answers
1k views

Benefit of using two network interfaces for intrusion detection system

What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
1
vote
1answer
260 views

How do I map the information in snort u2spewfoo output to the rule which triggered the alert?

I have a snort log file in unified2 format and I am able to view the output using the u2spewfoo utility. I think that I understand the generator id, signature id, and revision tell me why the alert ...
0
votes
2answers
470 views

how to write a snort rule to alert traffic that does not find any matched rules

Snort in IDS mode: If there is some traffic that does NOT find any matched rule against all existing Snort rules, how would you write a bottom rule to alert this traffic?
1
vote
1answer
409 views

pcap files for simulated attacks on SCADA systems?

I need to get hold of some pcap files belonging to a simulated attack on SCADA systems. My goal is to then use Snort for the detection. Or if somebody can suggest a practical environment to create my ...
3
votes
1answer
10k views

Snort/IDS detect and alert on possible DoS/DDoS attack?

As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack. Looking at the rulesets, which are primarily signature based rules, I can't see a ...
0
votes
0answers
502 views

Snort.log output as unreadable symbols

I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox. After installing and successfully validating the configuration ...
2
votes
1answer
534 views

Use Snort to limit or prioritize application bandwidth usage [closed]

Short version of a long story, we've been using bluecoat packetshapers for bandwidth control on a multi-tenant network. We like it because it allows us to divide the bandwidth equally, but still allow ...
1
vote
2answers
822 views

Snort Exercises

I am beginning to study Snort rules and the teacher give to us the next exercises: A server on which Snort is installed is monitoring all traffic on subnet 172.16.0.0 with mask 255.255.0.0. From now ...
2
votes
1answer
515 views

Where can I find a snort signature for detecting slowhttp DoS attack from Slowloris tool [duplicate]

I am performing a test on some DoS attacks and how to detect them. I am currently testing the slowloris tool, but all the signature I have seen online, as very very few as they are,do not work even ...
2
votes
1answer
347 views

Security Onion VMWare + OpenWRT IPTables Mirroring

I'm trying to set up SO in my home network to lab and see if I can monitor all ingress/egress traffic from my SOHO router. I don't have a switch with SPAN ports, or a network tap so I'm using OpenWRT ...
7
votes
3answers
713 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
3
votes
0answers
126 views

snort add more data in alert file

I want to add more data to alert file rightnow the data what our analyst team see is very minimal and we are not giving access to them to our snort backend server, our design is like centos /var/log/...
3
votes
1answer
1k views

How to detect a string in HTML with Snort?

I am trying to detect a string in HTML (already unzipped) with Snort. I set this rule to find content 7038685658 in my Apache web server's HTML: alert tcp any any <> any any (msg:"cell"; ...
0
votes
1answer
2k views

Snort priority range

What is the range of values for the 'priority' parameter in a Snort rule? The documentation it doesn't make it clear: The priority tag assigns a severity level to rules. A classtype rule assigns a ...