14
votes
Accepted
Threshold for DDOS Attack
Nowadays TCP SYN attacks are not common, focus more on UDP amplification attacks over DNS, memcache and other UDP services. On the other hand, if you want to compute the traffic rate you can use the ...
- 2,294
6
votes
Accepted
Benefit of using two network interfaces for intrusion detection system
The main benefit is speed. IDS isnt about prevention but rather about detection, so the packets that are routed to the production machine can be sent directly while the second port can mirror the ...
- 7,922
5
votes
Accepted
Is all Snort community rules available in Snort registered rules?
Is all snort community rules available in snort registered rules ?
Yes. snort Registered ruleset contains the Community ruleset. Ref
or shall I include registered rules only in my snort?
It ...
- 166
5
votes
Can Snort run on a Raspberry Pi?
Yes, you can. Here's how:
See section: "HOW TO INSTALL SNORT ON A RASPBERRY PI"
Follow some of the recommended best practices for expanding the memory space on your SD card once Raspbian is ...
5
votes
Benefit of using two network interfaces for intrusion detection system
It is generally recommended that the administration of a security device (IDS, firewall) should be done using a network you can trust as much as possible. One can assume that the network where the IDS ...
- 206k
4
votes
Can Snort run on a Raspberry Pi?
Simple answer is no. Snort, at a min, requires 1-2GB of RAM and even then it can struggle. It would be difficult to get it to run efficiently on a Pi3 and very very difficult, if not impossible on a ...
- 638
4
votes
Threshold for DDOS Attack
I don't think there's an absolute answer here.
A number of DDoS detection appliances and applications operate this way: You do a baseline measurement in bits/sec and packets/sec to determine what ...
- 6,948
3
votes
Snort detection_filter not alerting
In my case, I use this working alert rule for SYN Floods.
alert tcp any any -> 192.168.1.3 any (msg:"TCP SYN Flooding attack detected"; flags:S; threshold: type threshold, track by_dst, count 10 , ...
- 31
3
votes
Snort rules to detect Meterpreter sessions
I know this is an old question, but searching I found this interesting post. There are the hints you need. Extracted from there
You can do as Snort rule to detect Meterpreter sessions for external ...
- 5,335
3
votes
Accepted
In snort alert what does initial values "07/31-16:19:48.614462 [**] ...." mean?
Thats the time and date of the alert in the fastalert output format: MONTH/DAY-HOUR:MIN:SEC.MILIIS
- 303
3
votes
Accepted
IDS Snort rule to catch Slow-Loris
It looks like there are a couple of things in your signature that won't work:
Using the /H option in PCRE utilizes the HTTP preprocessor and says that the content needs to be matched against the ...
- 364
3
votes
Accepted
pcap files for simulated attacks on SCADA systems?
If you want pcaps from scada traffic you can go to http://www.netresec.com/?page=PCAP4SICS. On the other hand, if you want to simulate a specific attack probably the best option is to use scapy to ...
- 2,294
3
votes
Threshold for DDOS Attack
I believe the average rate these days (Nov 2018) is on the order of 3 Gbps (though large scale attacks can easily go up to 100 Gbps). One note, TCP SYN floods are a fairly uncommon vector these days. ...
- 2,711
3
votes
Create a snort rule that will alert on traffic on ports 443 & 447
I had to solve this exact case for Immersive Labs! This is the rule you are looking for:
alert tcp any any -> any [443,447] ( msg:"Sample alert"; sid:1000001; rev:1; )
Also, I noticed your sid:1. ...
- 39
2
votes
Accepted
can snort rules be defeated by palindrome
The aim of a snort rule is not to match arbitrary content but potentially malicious content. A palindrom by itself is not malicious. And if you are able to construct a specific malicious palindrom ...
- 206k
2
votes
Accepted
How should a network be configured for an IDS server?
You need to select your IDS location based on what you need. If you have a very small network with one switch, then this can be easy, but for a larger network estate there are a few options:
Gateway: ...
- 61.5k
2
votes
Troubleshooting Snort Rules
If you don't set specific ip to $SMTP_SERVERS in the snort.conf, that variable is any. And flowbits works in pairs. For example,
alert tcp any any -> any any (content:"aaa"; flowbits:set, NAMED; ...
- 171
2
votes
How to inspect TCP Header -> Optional Data with Snort?
Snort don't support to check tcp header length.
But if snort connecting to database, it can store optional data of ip and tcp.
- 171
2
votes
Snort Alert - What is PROTO:255?
The one byte wide protocol field in the IPv4 header has all of its bits set. This doesn't mean anything in particular as IANA (Internet Assigned Numbers Authority) hasn't assigned that protocol ...
2
votes
REJECT Nikto Scans With Snort Rules
If you use Official Snort Ruleset then it is already included inside ruleset:
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET SCAN Nikto Web App Scan in Progress"; flow:to_server,...
- 10.2k
2
votes
Can Snort run on a Raspberry Pi?
I am using a Raspberry Pi 4, and cannot find Snort within any of the repositories as they do not support ARM architecture.
sudo apt-get install snort works fine on a virtualized environment but not ...
2
votes
Major differences between Snort and Snort 3.0
From the https://www.snort.org/snort3 web page linked to from the page you linked, they list the following:
Support multiple packet processing threads
Shared configuration and attribute table
Use a ...
- 34.6k
2
votes
Accepted
Snort priority range
The short answer:
Whatever your heart desires.
Just tested up to priority:1000000; and works just fine.
What it says in the manual:
The following was put under §3.4.6 - classtype, the section ...
- 364
2
votes
Accepted
how to write a snort rule to alert traffic that does not find any matched rules
I'm sorry, but Snort is not really designed for that. It sounds like you're wanting something more like a firewall.
Snort is an Intrusion Detection System, whose job is to highlight on suspicious or ...
- 364
2
votes
Accepted
Analyzing Apache log with Snort
Your approach to this is...a bit misguided.
You shouldn't need to be crafting packets to replay events from an Apache log. The log is a list of HTTP requests, so use a library that can make proper ...
- 6,338
2
votes
Accepted
Is there a way to change the format of the output from snort?
Actually, I figured it out. I can output my alerts as a .csv file by adding a line to my snort.conf file:
output alert_csv: stdout proto,tcpflags,src,srcport,dst,dstport,msg
and then running snort ...
- 153
2
votes
Accepted
How to analyze .pcap file to write a generic snort rule to detect c&c activity
Step #1 is to identify and isolate the malicious traffic in the pcap. I assume you're using Wireshark to do this?
Step #2 Look at the isolated malicious stream and try to identify unique patterns. ...
- 8,193
2
votes
Difference between Zeek (Bro) and Snort 3
Snort is more a traditional IDS/IPS which does some deep packet inspection and then applies signatures on the traffic in order to detect (and maybe block) attacks.
Zeek does not claim to be an IDS: ...
- 206k
2
votes
Accepted
Can an Intrusion Prevention System (e.g. Snort) prevent CSRF and XSS attacks?
Intrusion Prevention System is a broad term. It basically says only that it is a system to prevent intrusions and does not imply a specific technical implementations. Therefore a variety of systems ...
- 206k
2
votes
Accepted
Difference between to_server and from_client in snort
Technically? No. The difference is in the logic. Do you want to focus on what's coming from clients or do you want to focus on what's going to the server? Where is your detection? When do you want to ...
- 132k
Only top scored, non community-wiki answers of a minimum length are eligible