Questions tagged [snort]

Snort is an open source network intrusion detection and prevention system (NIDS/NIPS).

Filter by
Sorted by
Tagged with
1
vote
0answers
247 views

How to log only the TCP header using command line in snort or nmap? [closed]

I work with snort log file and now I need to extract the TCP header. My question is: How to log only the TCP header from the packets captured by snort log file (without the payload) using command ...
1
vote
2answers
4k views

How does the flow option of Snort work?

For example, flow:established is detecting only for packets with sessions connected. Then, the server is rejecting packets to received after the session is disconnected?
1
vote
1answer
748 views

Troubleshooting Snort Rules

I am trying to troubleshoot a bunch of flowbits generated by pulledpork from snortrules-snapshot-2990.tar.gz. WARNING: flowbits key 'file.pdf' is set but not ever checked. The line in the generated ...
1
vote
0answers
310 views

Snort generates an alert that is empty [closed]

I am working with commands that have already been tested to work but they aren't working now. This is my config file: alert tcp any any <> any any (msg: "/etc/passwd Payload Found"; content: "/...
4
votes
1answer
335 views

How to inspect TCP Header -> Optional Data with Snort?

I have been looking around for clues on how to define rules, decoders or preprocessors to be able to content-inspect the TCP Header's Optional Data ( The last 0-40 bytes of the TCP Header) TCP ...
2
votes
1answer
517 views

Where can I find a snort signature for detecting slowhttp DoS attack from Slowloris tool [duplicate]

I am performing a test on some DoS attacks and how to detect them. I am currently testing the slowloris tool, but all the signature I have seen online, as very very few as they are,do not work even ...
1
vote
0answers
210 views

SourceFire/Snort/FirePower Custom Regex Rule Error

I am getting an unknown/extra pcre option encounterederror when trying to save my custom rule. ^([A-HK-PRSVWY][A-HJ-PR-Y])\s?([0][2-9]|[1-9][0-9])\s?[A-HJ-PR-Z]{3}$ The rule is to match UK Vehicle ...
2
votes
1answer
536 views

Use Snort to limit or prioritize application bandwidth usage [closed]

Short version of a long story, we've been using bluecoat packetshapers for bandwidth control on a multi-tenant network. We like it because it allows us to divide the bandwidth equally, but still allow ...
1
vote
0answers
111 views

Snort Rules Data Structure

the IDS programm Snort uses a linked list to organize rules (ORT/OTN). This list is used in run time. How it is possible to view this data structure in run time? Any tip would be helpful. Thanks in ...
4
votes
1answer
2k views

Snort detection_filter not alerting

I am trying to implement a simple flooding attack alert by using this rule: alert tcp any any <> any any (msg:"Flooding attack!";detection_filter:track by_dst, count 4, seconds 1; sid:1000036) ...
1
vote
1answer
113 views

How should a network be configured for an IDS server?

If a linux virtual machine is deployed with snort installed, how does it detect traffic that's going to every other IP on the network? Does the network switch or vSwitch need to be configured a ...
0
votes
1answer
308 views

IDS recomended UI? [closed]

I been using Snort IDS, but I recently switched to Suricata IDS since is still community based, etc. With Snort I used to use Snorby... What UI for searching organizing, removing false positives ...
1
vote
0answers
437 views

Snort Show OS Fingerprint Scan Detection

when I run the OS fingerprinting scan with nmap, I don't know how to detect this with snort rules. Can you suggest a method for the rules to detect this?
1
vote
0answers
148 views

Snort&Suricata content replacement rule

I have to deal with Surikata IDS and its snort-compatible ruleset. Partially I need it in IPS mode for doing output traffic modifications. For now my "modifications" looks like this: ... pass tcp 192....
3
votes
0answers
77 views

Snort: Log request based on reply

I want to write a Snort rule that logs all HTTP requests where the reply contains a specific regex. Every rule I found only logs the packet it is currently evaluating (which would be the reply in my ...
3
votes
3answers
769 views

Why snort uses “alert” rule only?

Among community rules and registered rules, all are "alert" type rules only. Since there are more rule types like log,pass,activate,dynamic,drop,sdrop available , snort official rule sets use only ...
1
vote
1answer
979 views

Is all Snort community rules available in Snort registered rules?

I am working with snort. I have included both latest community and registered rules in my snort configuration file. During run time I found many rules have duplicated, that is some rules available in ...
5
votes
2answers
4k views

How can I read snort logs in NIDS mode?

I am reading some snort logs from a firewall, I could read some with "snort -r file" But when I had tried the newest logs I get this error: snort -r snort.log Running in packet dump mode -...
0
votes
1answer
108 views

In snort alert what does initial values “07/31-16:19:48.614462 [**] …” mean?

Can anyone please tell me what does initial values in a snort alert mean. E.g., what does "07/31-16:19:48.614462" mean in following alert 07/31-16:19:48.614462 [**] [1:86300000:1] 503 irc_bot_cmd ...
0
votes
1answer
621 views

How to know for which packet snort alert triggered for

How can we know exactly which packet alert triggered for? Please let me know how I can find exact packet. I understand that IP addresses are an indication but there are mostly too many packets in ...
1
vote
1answer
150 views

can snort rules be defeated by palindrome

IDS such as snort uses string match or PCRE as basis for the rules. A string rule will only match one pattern, a PCRE rule can match a list of patterns. I wonder if hackers can use palindrome to ...
5
votes
2answers
4k views

Snort rules to detect Meterpreter sessions

I am learning while configuring Snort, my setup consists in an attacker (Linux), a victim (Android smartphone) and one detection system (IDS). So far, I have been able to log all the packets between ...
0
votes
1answer
826 views

Suricata Signature Explanation

I am trying to figure out some Suricata(or Snort) signatures, more specifically, what they mean, what they prevent and have some problems about meanings of keywords. I will not write irrelevant parts. ...
2
votes
1answer
312 views

Questions on snort generating too many events and not sending to syslog

New to snort here. I downloaded snort (2.9.6.0 GRE Build 47) on my Ubuntu 14.04, also downloaded emergingthreat rules. I ran the following command root@myhp:~/pkgs/emergeThreats/snortRules# snort -...
1
vote
0answers
48 views

Snort Modules Tweaking

I want to tweak and add new functionalities to snort code(Preprocessor)(v2.9.8). So,i have installed snort using source code,on ubuntu 14.04,however due to unknown problems,functionalities aren't ...
1
vote
1answer
413 views

Snort false positive, yet suspicious

I have Snort installed and tuned nicely with ET Rules on my pfSense, both my pfSense and the modem are using Googles public DNS 8.8.8.8. Recently I was denied access to google.com, and by reviewing ...
1
vote
3answers
496 views

Snort Unable to detect portscans in LAN

Setup Information I am doing experiment on portscan detection using snort 2.9.8.I have 10 systems in my lab with id:1,2,3,...,10. i have installed snort in my lab-pc with id:1.Now i am using Pc with ...
2
votes
0answers
682 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
1
vote
0answers
47 views

snort spp_sfPortscan Preprocessor Customization [closed]

I am working in snort 2.9.8.0. I want to modify the snort code for Portscanning Detection,i.e spp_sfPortscan.c and its related code to build a customized portScan detector. Ex:suppose A is scanning ...
3
votes
2answers
14k views

Snort “Protocol mismatch” from SSH preprocessor

TL;DR -- What does "protocol mismatch" even mean, and how is this a threat? Can I just suppress it? We are busy tuning Snort. The SSH preprocessor section looks like this, which comes directly from ...
5
votes
1answer
3k views

Documentation on Snort rules and alert tuning, especially for new users

I just started using Snort. There is a lot to it. I'm just looking for better documentation of what some of the Snort rules actually mean -- i.e. How I should react to them when I have an alert for a ...
0
votes
1answer
2k views

(spp_sdf) SDF Combination Alerts in Snort

I'm testing Snort in IDS mode and have been receiving a few (spp_sdf) SDF Combination Alerts as below. Seems like it happens when I visit certain but not all https sites. Tried to google this alert ...
1
vote
1answer
1k views

Are snort rules applied per packet or per flow

I would like to understand if snort rules are applied for each packet in a flow between a source and destination separately? For instance, when packet 1 of the flow arrives at the IDS, all the rules ...
0
votes
1answer
346 views

snort rule to detect relay attempt not working

I am trying to detect a relay attempt on smtp server, but nothing gets logs when I test it out. The snort rule to detect a relay attempt which I tried using is: alert tcp $SMTP_SERVERS 25 -> ...
4
votes
1answer
2k views

How do I use a directory of YARA files?

I'm going through the Malware Cookbook PEScanner and they want a path to my YARA files to search on. I currently have a directory full of YARA rules for known pieces of malware. What would be the ...
3
votes
1answer
215 views

How to make Snort not log sensitive data from the sniffed traffic?

I have Snort in my network which I use for IDS and it is residing on a VM that receives all mirrored traffic from the switch. I am having a web applications that users use and they login, operate on ...
2
votes
1answer
4k views

Understanding Snort log

I am new to Snort, and I have ran Snort through a .cap file and got the logs that I should interpret. If I take for instance a block of log like the one below: [**] [1:2463:7] EXPLOIT IGMP IGAP ...
0
votes
1answer
465 views

fwsnort - How safe compared with Snort/Suricata?

How safe is 'fwsnort' compared to a real Snort / Suricata instance? What's the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is ...
1
vote
0answers
36 views

Adding Windows 7 VM as a log source/forcing the IDS inline

I'm investigating ways to add my Windows 7 VM as a log source or even run that traffic through my IDS VM and then out to the internet but I'm not entirely sure how to approach it. Does anybody have ...
1
vote
0answers
32 views

get session data (stream data) into Snort ids [closed]

Can any one point to me where (in the code) Snort are stored just before they send to httprespect or got written to the output files? Thanks.
1
vote
0answers
109 views

Snort signatures not working [closed]

I am using snort to detect signature for IDS but some rule not detected by snort which is highlighted below. Kindly, sort this out, I'm stuck here.
0
votes
1answer
331 views

What does this snort rule mean?

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MALWARE-BACKDOOR access remote pc runtime detection - init connection"; flow:to_server,established; content:"|99 F3 00 00 00 00 00 00 FF FF FF FF|"...
1
vote
0answers
2k views

Snort gives “could not create the registry key” error for multiple kinds of operations

I've set up a host-only network in Virtualbox consisting of a Kali linux machine and a Windows 7 machine (the host is running OS X). I have Snort installed on Windows 7 and am attempting to verify ...
4
votes
1answer
471 views

Problem with Snort rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Get2 method"; flow: to_server, established; dsize: >20; sid:1000006; priority: 15) Snort does not generate any alert, whereas when I write the ...
-1
votes
1answer
3k views

snort rule explanation

I'm quite new to Snort, Could anyone explain these two rules? Specifically, why do they contain more than one "content" field ? alert tcp $EXTERNAL_NET any -> $HOME_NET any ( msg:"ET TROJAN Reply ...
20
votes
5answers
6k views

DoS in local network computer

I'm using Snort to study detection, and I wanted to simulate a DoS attack from the inside to another computer in my home network, but I have a question. If I start to flood the target computer with ...
0
votes
1answer
295 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
3
votes
1answer
588 views

How use snort with local.rules in offline mode?

I'm using SecurityOnion distro and I would to run snort on my pcap files. Is there a way to specify just one rule? I couldn't understand whether local.rules is used. How can I show only the result ...
1
vote
1answer
447 views

SNORT sfportscan alert format [closed]

How can I modify the output alert from sfportscan ? Ex : output alert_csv: /var/log/snort/portscan.log timestamp,src,dst,dstport,msg OBS: I can set output for default alert file with this method ?
1
vote
1answer
2k views

What does the http_uri content modifier do is SNORT

I am very confused about exactly what http_uri does. Can someone explain this to me w.r.t NORMALIZED and UNNORMALIZED uri fields?