Snort is a software package used for network intrusion detection.

learn more… | top users | synonyms

0
votes
0answers
44 views

Snort 2.9.2 doesn't see local network traffic any more

I installed Snort 2.9.2 + ACID BASE + Postgresql on Ubuntu Server LTS 12.04 about 5 month ago. Snort host have local IP address 10.0.40.3/24. There is a some hosts in 10.0.40.0 network. After ...
1
vote
1answer
25 views

Snort logging mode - How to define subnets

I am using snort to log all traffic on an interface snort -i eth1 -l /interface/log/dir -b -U -m 112 With this command I manage to get ALL data which makes my log files very large. Is there any ...
0
votes
0answers
23 views

Can IPtables (possibly with libnetfilter_queue library) do everything that snort does?

I have just started getting into network security, firewall, etc. So, please excuse me for asking this basic question. I looked at IPtables and got a good hang of it (nowhere close to becoming an ...
0
votes
2answers
39 views

How do I set Securityonion/snort to not capture certain packets?

After looking through my pcaps from Security onion I'd like to filter out a host (let's call it 192.168.4.4) and filter out some traffic (ports 80 & 443), current project is to look at other ...
0
votes
0answers
14 views

snort is not alerting to a web console

I am configuring snort in OSSIM, modified the snort.debian.conf and when I check the status it gives OK. But it is not logging as I have checked the file. How can I get the alerts logged and on the ...
0
votes
0answers
39 views

Snort configuration in OSSIM

I am working on snort, the one built-in with OSSIM. I am trying to configure it to get the alerts on ossim web-interface but I am unable to even start it properly. I am using 1 NIC although have ...
1
vote
3answers
113 views

Snort not detecting outgoing traffic

I'm using Snort 2.9 on windows server 2008 R2 x64, with a very simple configuration that goes like this: # Entire content of Snort.conf: alert tcp any any -> any any (sid:5000000; ...
0
votes
0answers
226 views

Installing and configuring Snort, Barnyard2 on ubuntu 13.10 server 64 bit in AWS EC2 VPC

I need you help after searching a whole lot and asking AWS my problem is not getting resolved, so I have come here for your help. I have a AWS VPC setup with all ubuntu servers I have a NAT server ...
0
votes
0answers
56 views

Barnyard2 output log_syslog_full

I am trying to get barnyard2 to take the unified2 output from snort and send a full syslog message to localhost but I cant seem to get it to work: I am looking for a syslog message with as much ...
1
vote
1answer
105 views

Snort, Portscans and Scanned IP Range field

According to manual.snort.org, TCP Portscans goes from one computer to other one, but when you take a look to an tcp portscan alert in snort/snorby you can see this: In one hand: Source: ...
0
votes
1answer
62 views

Snort configuration

I'm trying to configure Snort on a security probe and I am having an error: FATAL ERROR: database: mysql_error: Can't connect on MYSQL server on "x" (111). I have set up the account with privileges ...
0
votes
0answers
13 views

Have snort report MD5s of exfiltrated files and report if a specific file is exfiltrated

I would like to create a set of snort rules to report if a specific file is exfiltrated from my organization. I'd also like to have snort report the MD5 of every file that is sent over my network ...
0
votes
1answer
172 views

Should I Install Snort on my web server? [closed]

I've been thinking about installing snort on my dedicated server. I got about 100 domains/clients. What should I be considering here for pros and cons? Memory usage, bandwidth impact?
0
votes
0answers
205 views

Snort not creating unified2 log file

I'm trying to set up Snort + Barnyard2 + Snorby on CentOS 6.4 64-bit, but am stuck on getting Snort write out a unified2 format log file. My output config line: output unified2: filename merged.log, ...
1
vote
1answer
19 views

Monitor a machine plugged on a mirroring interface

I've read that if I configure port span, I can no longer use that interface to pass normal trafic. However, I'd like to monitor the machine plugged to that interface, with nagios.. Does anyone know ...
0
votes
2answers
350 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
0
votes
1answer
184 views

OSSIM Alarms for Snort rules

I'm new to OSSIM. My requirement is to detect executable files (.exe) using snort. I have found a snort rule: alert tcp any any -> any any (msg: "DLL Windows file download"; flow: established; ...
0
votes
0answers
73 views

Snort error on FreeBSD-9: Unknown preprocessor “ftp_telnet”

I've installed "Snort" on FreeBSD-9.1 (32-bit) from the standard ports using: pkg_add -r snort After configuring and running with: snort -c /etc/snort/snort.conf -A full -u snort -g snort -i em1 ...
1
vote
2answers
393 views

pfSense and Snort: unexpected portscan traffic on interface

I have a pfSense box acting as my public facing router and stateful firewall. There is 1 WAN interface and several LAN interfaces using private IPs behind NAT. I EXPECT to see portscans or all kinds ...
2
votes
3answers
446 views

Snort Based Firewall

I have not worked with SNORT much or done too much research on this but it sounds possible. If I setup a server and run snort on it. Would it then be possible to route ALL my traffic through it like ...
0
votes
1answer
135 views

Using Snort without a port mirrored switch

I am trying to set up a Snort IDS on a virtual machine for my lab. My problem is that normally, these kinds of IDS are connected to the mirrored port of a switch. My lab has no such device. Here is my ...
1
vote
1answer
134 views

What class of software should I use to intercept HTTP requests and perform an action

We have inherited an old Web application that needs to be extended with some logging capacities for compliance purposes. Unfortunately, we can't change the application. The application receives XML ...
1
vote
0answers
111 views

Is Snort able to efficiently demux and log large HTTP POST requests?

I'm trying to debug some failed HTTP POST requests containing large file uploads (~500 MB). The end-user is receiving strange HTTP responses that are not being logged in either varnish's varnishncsa ...
1
vote
0answers
136 views

Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging

With log_syslog_full opertion mode set to complete you get the below output. Can some explain to me what the bold parts are? I have been searching and cannot find any documention explaining the new ...
1
vote
2answers
304 views

how can a mirror all of the traffic on a network interface, to virtual interface

I am trying to setup snort to act as an ids, on a debian machine that also functions as a router. Ideally I would like to setup snort in such a way so that I would not have to purchase an additional ...
2
votes
0answers
96 views

Configuring Barnyard2 Output Plug-In Per Input Source

I am currently using snort-2.9.3.1 outputting unified2 log format and using barnyard2-1.9 to process the alerts and send them to both syslog and a database. In some cases I have multiple instances of ...
1
vote
0answers
375 views

Ubuntu 12.04 Server snort 2.9.2.3 not logging NMAP Scans after first VTR Rules update

I install snort 2.9.2.3 from the Ubuntu repositories along with Oinkmaster. I'm not running LAMP just snort for logging pcap and to the alert log file. Out of the box installation snort worked. ...
0
votes
1answer
326 views

snort-mysql not starting on Ubuntu server

I am following this tutorial: https://help.ubuntu.com/community/SnortIDS I've set up the database, everything has installed correctly, and I've configured the snort.conf file so it outputs to a ...
1
vote
1answer
2k views

Tuning Snort Rules: COMMUNITY SIP TCP/IP message flooding directed to SIP proxy

This is a common problem in Snort, but I'm not sure why the rule triggers at all. The rule below comes from the Debian repositories. Apparently it is designed to trigger when there are more than ...
2
votes
1answer
48 views

POLICY Mozilla Multiple Products HTML href shell attempt - SNORT

We've had a few of these alerts get triggered through Snort: "POLICY Mozilla Multiple Products HTML href shell attempt" I'm struggling to find any information pertaining to this alert, does anyone ...
0
votes
1answer
206 views

snort intrusion detection

Hi im trying to use snort as an IDS on some pcap files I have, I was hoping I would get a log of any intrusions. I know for a fact that there is port scans and ping sweeps etc in the pcap files but ...
2
votes
1answer
691 views

Snort/Barnyard2 Logging

I need some help with my Snort/Barnyard2 setup. My goal is to have Snort send unified2 logs to Barnyard2 and then have Barnyard2 send the data to other locations. Here is my currrent setup. OS ...
2
votes
0answers
144 views

Implications of unified2 logging with multiple instances of snort

I am beginning to migrate my snort logging from alert_syslog to unified2 using barnyard2 as the processor. In some cases I have multiple instances of snort running on the same system. Since I have ...
0
votes
1answer
453 views

Snort: not logging anything

My site seems to be the target of quite a bit of probing over the last few months. In an attempt to get a better handle on this I installed SNORT on one of the machines that has external exposure. ...
-2
votes
1answer
293 views

Remote logging from snort to rsyslog

As part of a school project, we are supposed to run snort on a Ubuntu server in IDS mode and log the packets to rsyslog on a remote Ubuntu server. I have been searching for manuals/tutorials for a ...
2
votes
1answer
637 views

snort not logging full output to syslog

I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
-4
votes
2answers
312 views

Portscan attacks from somewhere

I realize this is a lamer/beginner question, but I've been attacked by a couple of addresses in China and I'm not sure how to close the hole. My snort logs (yes I'm using snort! I see you are ...
0
votes
0answers
128 views

Sniffing Email Address with Snort

I am new to snort rules and need a rule that will alert any email from a specific user.. For example: alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"email@thatemail.com"; ...
3
votes
2answers
527 views

specifying snort output files?

I'm confused about snort outputs. Where are the output file(s) supposed to be specified? OR, more specifically, I've got two files being written (alert and snort.log.xxx), but only have one output ...
2
votes
1answer
1k views

Centos KVM Host OS not passing all network traffic Guest OS

I'm running KVM on Centos 5. I have a guest OS, ubuntu 10.04, that has Snort 2.9 installed on it. The guest OS has (2) nic's, eth0 and eth1. One nic, eth0, is configured with an IP and can be ...
0
votes
1answer
252 views

How can I detect DNS label Decoding DoS (Cross Reference at DNS decompression) with Snort?

I want to add some rules or download some ready rules to detect DNS label Decoding DoS (Cross Reference at DNS decompression) can anyone know how can I do this?
1
vote
2answers
2k views

Snort [PFSense] is configured but not blocking or generating alerts!

I've got PFSense V 2.0-RC1 (i386) and I've got the latest version of Snort installed I've loaded up a bunch of rules from Oinkmaster, I've enabled all of the preprocessors, and I've ensured the ...
4
votes
2answers
1k views

Is there an appliance-style distribution with web-based configuration for Snort?

There are some great "appliance" style distributions like pfSense and M0n0wall, that bundle powerful features of their respective operating systems with a nice web application for configuration. In my ...
1
vote
0answers
58 views

snort not alerting on rule if IE is used

Hi I have snort rules to alert for specific host name and URL. when I tested I see that snort is not alerting if I use internet explorer 8, but alerting if i use firefox and safari after analysis , i ...
0
votes
1answer
266 views

how to do fragmentation attack via ubuntu machine

I wish to test my system which has snort installed on it. I want to do fragmentation attack such as tiny fragment attack and wish that it should be logged by snort. any suggestions? any graphical ...
0
votes
1answer
214 views

Snort Excluding Multiple Ports From ShellCode rules

How can I specify mutliple ports to exclude from shellcode rules? I'm using the latest version of snort. I'm also interested in knowing which ports should generally be excluded.
2
votes
2answers
709 views

Custom Rules for Snort

I need to allow certain traffic through which is being blocked by snort eg ICMP from a specific address. How can I do this?
0
votes
2answers
275 views

My snort graphs have no words

I just got Security+ certified and stared to care about my network (or use my newly aquired knowledge to make everything better) I just installed Snort the open source IDS. I am having one issue ...
11
votes
2answers
583 views

Snort Performance Monitoring

Using snort version 2.8.6, I am attempting to collect application performance stats such as Number of packets not processed due to application overload Percentage of time in processing layers ...
7
votes
2answers
1k views

snort analysis of wireshark capture

I'm trying to identify trouble users on our network. ntop identifies high traffic and high connection users, but malware doesn't always need high bandwidth to really mess things up. So I am trying ...