Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [snort]

Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

Filter by
Sorted by
Tagged with
20
votes
5answers
6k views

DoS in local network computer

I'm using Snort to study detection, and I wanted to simulate a DoS attack from the inside to another computer in my home network, but I have a question. If I start to flood the target computer with ...
13
votes
5answers
59k views

Testing Snort IDS installation

What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work? alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
10
votes
3answers
11k views

Snort's great, but BASE isn't. What are some alternative front-ends?

BASE is an improvement over ACID, but it's easy to tell that it's maintained by someone who doesn't use it. There's no at-a-glance overview of network activity like you get with McAfee's NUBA IDS and ...
9
votes
1answer
3k views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
7
votes
2answers
4k views

Snort Sensor Placement

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
7
votes
3answers
751 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
6
votes
1answer
2k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
5
votes
1answer
4k views

Bench marking Snort and other IDS/IPS

I am looking for facts and figures of research or surveys done which have bench-marked Snort with other IDS/IPS on various parameters like overall performance, accuracy, speed, documentation, ...
5
votes
1answer
5k views

Snort alert log simple question

I am analyzing Snort alert log and cannot figure what [1:1071:6] means in 10/12-12:44:28.793118 [**] [1:1071:6] WEB-MISC .htpasswd access [**] [Classification: Web Application Attack] [Priority: 1] ...
5
votes
4answers
5k views

Unicast ARP Requests: Considered Harmful?

I'm playing around with Snort's downloadable rules and I found one which is easy to activate: sending a unicast ARP request. Okay, so I start injecting ARP requests, making sure the destination is not ...
5
votes
2answers
4k views

Snort rules to detect Meterpreter sessions

I am learning while configuring Snort, my setup consists in an attacker (Linux), a victim (Android smartphone) and one detection system (IDS). So far, I have been able to log all the packets between ...
5
votes
1answer
3k views

Documentation on Snort rules and alert tuning, especially for new users

I just started using Snort. There is a lot to it. I'm just looking for better documentation of what some of the Snort rules actually mean -- i.e. How I should react to them when I have an alert for a ...
5
votes
2answers
16k views

Snort (IDS) Don't show Port Scans

I have install Snort & acidbase by this instruction and access it through this local address 127.0.0.1/acidbase/base_main.php The problem is after scan it with nmap by this command sudo ...
5
votes
1answer
2k views

Setting up home lab with Snort and Vyatta - looking for resource recommendations or advice

I'm looking to turn a new desktop (Ubuntu 12.10-64bit) I built into a virtual home lab for testing and experimenting with various security things. The first setup I would like to try running is the ...
5
votes
2answers
5k views

How can I read snort logs in NIDS mode?

I am reading some snort logs from a firewall, I could read some with "snort -r file" But when I had tried the newest logs I get this error: snort -r snort.log Running in packet dump mode -...
4
votes
3answers
3k views

Threshold for DDOS Attack

I am trying to understand and simulate SYN Flood DDOS attacks. I am using snort to give me alerts. While I have control over the rate for my testing, I am interested in knowing what a good estimate of ...
4
votes
2answers
1k views

Can installing Snort make me vulnerable?

I am using Ubuntu and am wondering if installing Snort on my host can make me more vulnerable?
4
votes
4answers
1k views

Benefit of using two network interfaces for intrusion detection system

What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
4
votes
1answer
2k views

Outbound TFTP request to 255.255.255.255

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255 Anyone have a clue as to what this may ...
4
votes
3answers
2k views

Log Attacks in Different Files using Snort

How can I log attacks separately using snort. I basically want to log attacks invoked from different files separately. Like if I have 2 files, ddos.rules and log.rules, then I want logs generated from ...
4
votes
2answers
4k views

Can you have 2 promiscuous (sniffing) ports on a single machine?

I'm wondering if you can actually have 2 (or more) promiscuous (sniffing) ports on a single machine, to monitor multiple network segments? And can you monitor them all with snort?
4
votes
2answers
191 views

Taking action for exploit attempts

Just recently I see I have had about 40 hits in one second for the following Snort rule- signature id 1:16008, which corresponds to the CVE-2007-6239: "... allows remote attackers to cause a denial of ...
4
votes
1answer
819 views

Help setting up Snort on Windows 7

I'm configuring Snort on Windows 7 with the help of this guy and I'm stuck at the following line in the config file: List of DNS servers on your network. I have multiple, how do I separate them? ...
4
votes
1answer
347 views

How to inspect TCP Header -> Optional Data with Snort?

I have been looking around for clues on how to define rules, decoders or preprocessors to be able to content-inspect the TCP Header's Optional Data ( The last 0-40 bytes of the TCP Header) TCP ...
4
votes
1answer
2k views

Snort detection_filter not alerting

I am trying to implement a simple flooding attack alert by using this rule: alert tcp any any <> any any (msg:"Flooding attack!";detection_filter:track by_dst, count 4, seconds 1; sid:1000036) ...
4
votes
1answer
1k views

Logging True/False Negatives on Snort

I'm using Snort in a lab environmnet with artificially generated traffic. I'm looking to build a confusion matrix from known generated attacks. True Positives and False Positives are easy to parse ...
4
votes
3answers
1k views

Reading Wireshark Result and Security Learning Recommendation

I am (not so) currently learning about security and right now I am learning about using Wireshark. I bumped into this video: http://www.wonderhowto.com/how-to-detect-network-intrusions-with-wireshark-...
4
votes
1answer
2k views

How do I use a directory of YARA files?

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...
4
votes
1answer
491 views

Problem with Snort rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Get2 method"; flow: to_server, established; dsize: >20; sid:1000006; priority: 15) Snort does not generate any alert, whereas when I write the ...
4
votes
1answer
1k views

SSL protocol issues on OS X and iOS

I have a PfSense box as a UTM, running snort among other things. I started noticing that when MacBooks and iPhones/iPods connect to my network, the snort log gets flooded with this message: (...
4
votes
0answers
806 views

Security Onion: Snorby alerts show all local network source IP (public and private)

I have recently installed the Security Onion distro for Ubuntu. This distro does a great job of combining multiple tools like snort/suricata, sguil, snorby, elsa, bro ids, squert, etc. Within my ...
3
votes
3answers
12k views

Can Snort run on a Raspberry Pi?

I am in the preliminary stages of designing a cybersecurity suite for my home network. I don't have any servers or anything, just the standard home setup (computers, tablets, game consoles). The ...
3
votes
1answer
1k views

What is the danger of the “FTP RNFR ././ attempt”?

I am analysing an old attack and I got a scenario which does not really make sense to me. The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as ...
3
votes
2answers
14k views

Snort “Protocol mismatch” from SSH preprocessor

TL;DR -- What does "protocol mismatch" even mean, and how is this a threat? Can I just suppress it? We are busy tuning Snort. The SSH preprocessor section looks like this, which comes directly from ...
3
votes
2answers
901 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
3
votes
3answers
783 views

Why snort uses “alert” rule only?

Among community rules and registered rules, all are "alert" type rules only. Since there are more rule types like log,pass,activate,dynamic,drop,sdrop available , snort official rule sets use only ...
3
votes
1answer
223 views

How to make Snort not log sensitive data from the sniffed traffic?

I have Snort in my network which I use for IDS and it is residing on a VM that receives all mirrored traffic from the switch. I am having a web applications that users use and they login, operate on ...
3
votes
1answer
1k views

How to detect changing IP address and user agent on a HTTP session?

I have some HTTP logs where I see the hacker changing his IP every request, and occasionally changing his useragent. Is there a way to detect this automatically? Perhaps a snort rule? or any other ...
3
votes
1answer
10k views

Snort/IDS detect and alert on possible DoS/DDoS attack?

As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack. Looking at the rulesets, which are primarily signature based rules, I can't see a ...
3
votes
1answer
4k views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
3
votes
1answer
1k views

How to detect a string in HTML with Snort?

I am trying to detect a string in HTML (already unzipped) with Snort. I set this rule to find content 7038685658 in my Apache web server's HTML: alert tcp any any <> any any (msg:"cell"; ...
3
votes
1answer
617 views

How use snort with local.rules in offline mode?

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used. How can I show only the result ...
3
votes
0answers
132 views

snort add more data in alert file

I want to add more data to alert file rightnow the data what our analyst team see is very minimal and we are not giving access to them to our snort backend server, our design is like centos /var/log/...
3
votes
0answers
78 views

Snort: Log request based on reply

I want to write a Snort rule that logs all HTTP requests where the reply contains a specific regex. Every rule I found only logs the packet it is currently evaluating (which would be the reply in my ...
2
votes
3answers
5k views

Using an IPS as an alternative to mod_security

I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such ...
2
votes
2answers
13k views

How to connect sensors such as Snort to AlienVault SIEM?

I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?
2
votes
2answers
4k views

What type of data does Snort log?

This is new to me, but what types of data does Snort log for Network Intrusion Detection? I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
2
votes
2answers
1k views

How to detect Snort on the network?

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.
2
votes
1answer
2k views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
2
votes
1answer
1k views

Open source or common implementations for reverse proxy web application security

I realize there is already a question similar to this one, but this is somewhat of a follow-up. I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...