Questions tagged [snort]

Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

36 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
534 views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...
4
votes
0answers
835 views

Security Onion: Snorby alerts show all local network source IP (public and private)

I have recently installed the Security Onion distro for Ubuntu. This distro does a great job of combining multiple tools like snort/Suricata, Sguil, Snorby, Elsa, bro ids, Squert, etc. Within my ...
3
votes
0answers
152 views

snort add more data in alert file

I want to add more data to alert file rightnow the data what our analyst team see is very minimal and we are not giving access to them to our snort backend server, our design is like centos /var/log/...
3
votes
0answers
80 views

Snort: Log request based on reply

I want to write a Snort rule that logs all HTTP requests where the reply contains a specific regex. Every rule I found only logs the packet it is currently evaluating (which would be the reply in my ...
2
votes
2answers
316 views

Can dual NIC Snort machine cause threats to bypass firewall?

I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic. Setup I am thinking about: Snort computer with two NICs One NIC connected to hub/tap outside firewall (...
2
votes
0answers
768 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
1
vote
2answers
76 views

Difference between Zeek (Bro) and Snort 3

I'm trying to find difference between Zeek and Snort 3. Сan anybody tell me what are the advantages of Zeek against Snort 3?
1
vote
0answers
184 views

Stateful detection in Snort

From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules. What if I wish to have a rule based on multiple packets such as analysis of a ...
1
vote
1answer
697 views

How to sniff VPN traffic using Snort?

Here's what I want to do: I want to use a VPN client on my PC (like TunnelBear). Then I want to use Snort to sniff traffic before it's encrypted and after it's decrypted by VPN. So basically I want ...
1
vote
0answers
306 views

Are these Snort rules correct?

I wrote this rule so that when there are more than three failed SSH connection attempts that there is an alert but it is not working. Are these rules badly written? Or if not I ask the exact writing ...
1
vote
0answers
175 views

Snort not working with IDSWakeup

I have setup Snort with the registered user rules installed. I tested first by making the following rule in local.rules: alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
1
vote
0answers
125 views

Signature Generate by Honeyd “Honeycomb” is not accept by Snort IPS

I posted this on SO [https://stackoverflow.com/questions/44652014/signature-generate-by-honeyd-honeycomb-is-not-accept-by-snort-ips] is this on topic here? What would I need to do to my question ? I ...
1
vote
0answers
389 views

Detecting Guest to Guest Traffic in Virtualbox Using Host Running Snort

Not sure if this is a simple question but I was hoping for some insight into finishing a pentest lab. My goal is to have Snort sniff an attack in a virtual environment between two guest VM's. My ...
1
vote
0answers
262 views

SourceFire/Snort/FirePower Custom Regex Rule Error

I am getting an unknown/extra pcre option encounterederror when trying to save my custom rule. ^([A-HK-PRSVWY][A-HJ-PR-Y])\s?([0][2-9]|[1-9][0-9])\s?[A-HJ-PR-Z]{3}$ The rule is to match UK Vehicle ...
1
vote
0answers
120 views

Snort Rules Data Structure

the IDS programm Snort uses a linked list to organize rules (ORT/OTN). This list is used in run time. How it is possible to view this data structure in run time? Any tip would be helpful. Thanks in ...
1
vote
0answers
501 views

Snort Show OS Fingerprint Scan Detection

when I run the OS fingerprinting scan with nmap, I don't know how to detect this with snort rules. Can you suggest a method for the rules to detect this?
1
vote
0answers
166 views

Snort&Suricata content replacement rule

I have to deal with Surikata IDS and its snort-compatible ruleset. Partially I need it in IPS mode for doing output traffic modifications. For now my "modifications" looks like this: ... pass tcp 192....
1
vote
0answers
50 views

Snort Modules Tweaking

I want to tweak and add new functionalities to snort code(Preprocessor)(v2.9.8). So,i have installed snort using source code,on ubuntu 14.04,however due to unknown problems,functionalities aren't ...
1
vote
1answer
485 views

Snort false positive, yet suspicious

I have Snort installed and tuned nicely with ET Rules on my pfSense, both my pfSense and the modem are using Googles public DNS 8.8.8.8. Recently I was denied access to google.com, and by reviewing ...
1
vote
0answers
36 views

Adding Windows 7 VM as a log source/forcing the IDS inline

I'm investigating ways to add my Windows 7 VM as a log source or even run that traffic through my IDS VM and then out to the internet but I'm not entirely sure how to approach it. Does anybody have ...
1
vote
0answers
3k views

Snort gives “could not create the registry key” error for multiple kinds of operations

I've set up a host-only network in Virtualbox consisting of a Kali linux machine and a Windows 7 machine (the host is running OS X). I have Snort installed on Windows 7 and am attempting to verify ...
1
vote
0answers
198 views

Barnyard2 Can't pull xref from unified2 format

I have snort configured to log unified2 in my snort.conf file and am using barnyard2 to parse the unified2 results. It works, except I can seem to figure out to pull the event reference (xref) out of ...
1
vote
0answers
482 views

Snort sfportscan does not log in unified2 file format

I'm running Snort version 2.9.6.0 and I'm not able to log events from the sfportscan preprocessor using the unified2 file format. This is the conf (actually is the default one): preprocessor ...
1
vote
0answers
1k views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
0
votes
0answers
31 views

Snort analyze reply based on request

I'm trying to write a snort rule which detects if certain binary files where requested via HTTP based on a regex rule matching there names. But it should only send an alert if the file exists (e.g. ...
0
votes
0answers
41 views

Trying to use SNORT to alert all non-http traffic on port 80

I am using Snort 2 and I can't find anything that will specifically rule out the HTTP traffic so that I can alert for any other traffic coming in (or out) on port 80.
0
votes
0answers
30 views

Is there an easy Snort rule to CVE mapping database somewhere?

I feel like should be an easy way to map between SNORT rules and associated CVEs. I'm aware of their own search function on their site at: https://www.snort.org/rule-docs, but I feel like it's giving ...
0
votes
0answers
20 views

Snort stops generating alerts when HOME_NET changed to public addresses

I have used snort for traffic analysis quite often and it worked fine as it generates rules that are corresponding to packets doing malicious activities on my HOME_NET which is always private ...
0
votes
0answers
84 views

error read-file in snort when reading back pcap file

I get this error when using snort -r to read a saved pcap file and apply snort rules on it. ERROR : pfring daq does not support read-file I am running snort in Security Onion I tried many things: ...
0
votes
1answer
3k views

Snort rule for syn flood attacks - Limiting number of alerts

So I have a snort rule that detects syn flood attacks that looks like this: alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S; flow: stateless; detection_filter: track by_dst, ...
0
votes
0answers
586 views

How to determine TLS traffic in snort signature

I am trying to have a snort signature that can detect encrypted traffic but I am not able to determine the TLS traffic using a snort signature. The content keyword search in the payload of the packet,...
0
votes
1answer
394 views

Are these snort alerts false positives or attacks?

Can anyone describe this alert please? I am confused if an attack is run against my network or not. I run snort IDS/IPS through a pfsense firewall.
0
votes
0answers
736 views

Snort.log output as unreadable symbols

I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox. After installing and successfully validating the configuration ...
0
votes
0answers
345 views

how to use snort to track http/https sessions separately?

how can I use snort to breakdown http/https traffic into separate sessions and track each session separately and also dump them into separate log files or something that I can read from.
0
votes
0answers
1k views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 (msg:"...
0
votes
0answers
68 views

Possible to run snort without modifiers?

Is there anyway (e.g some command line argument) with which we can tell snort to run and perform detection but without caring for the rule modifiers if there are any ? e.g alert tcp any any -> ...