Snort is a software package used for network intrusion detection.
1
vote
1answer
18 views
Monitor a machine plugged on a mirroring interface
I've read that if I configure port span, I can no longer use that interface to pass normal trafic.
However, I'd like to monitor the machine plugged to that interface, with nagios..
Does anyone know ...
0
votes
2answers
58 views
How to properly drop ICMP type 3 packets on possible DDoS attack?
Even after running
iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP
I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like:
19:41:31.923630 IP ...
0
votes
1answer
29 views
OSSIM Alarms for Snort rules
I'm new to OSSIM.
My requirement is to detect executable files (.exe) using snort. I have found a snort rule:
alert tcp any any -> any any (msg: "DLL Windows file download"; flow: established; ...
0
votes
0answers
16 views
Snort error on FreeBSD-9: Unknown preprocessor “ftp_telnet”
I've installed "Snort" on FreeBSD-9.1 (32-bit) from the standard ports using:
pkg_add -r snort
After configuring and running with:
snort -c /etc/snort/snort.conf -A full -u snort -g snort -i em1 ...
1
vote
2answers
80 views
pfSense and Snort: unexpected portscan traffic on interface
I have a pfSense box acting as my public facing router and stateful firewall.
There is 1 WAN interface and several LAN interfaces using private IPs behind NAT.
I EXPECT to see portscans or all kinds ...
2
votes
3answers
182 views
Snort Based Firewall
I have not worked with SNORT much or done too much research on this but it sounds possible.
If I setup a server and run snort on it. Would it then be possible to route ALL my traffic through it like ...
0
votes
0answers
48 views
upgrading snort
hi currently I am using snort 2.9.2 on Ubuntu 12.04 but I want to upgrade it to the latest version available, so I may able to get latest rule set.
my question is how can I upgrade my existing snort ? ...
0
votes
1answer
100 views
Using Snort without a port mirrored switch
I am trying to set up a Snort IDS on a virtual machine for my lab. My problem is that normally, these kinds of IDS are connected to the mirrored port of a switch. My lab has no such device. Here is my ...
0
votes
0answers
29 views
Segregate snort rules according to application layer protocol
I wish to get all the snort rules pertaining to attacks involving http, ftp, ssh, telnet etc. Is there a way to segregate the snort rules like this?
I want to create a distributed IDS/IPS using this ...
1
vote
1answer
69 views
What class of software should I use to intercept HTTP requests and perform an action
We have inherited an old Web application that needs to be extended with some logging capacities for compliance purposes. Unfortunately, we can't change the application. The application receives XML ...
0
votes
0answers
50 views
Proxy server with selective data capture [closed]
I have a third party product that uses the HTTPS protocol but has limited logging capacities.
Because of compliance requirements, I am looking for a kind of transparent SSL proxy that can capture ...
0
votes
0answers
24 views
barnyand2 not recording the events in the database (mysql, snort) [closed]
Hello guys recently i installed snort-2.9.4 + barnyand2.1.11
I configured unified2 output in snort.conf but when i start barnyan2 this not recording the data in the mysql database.
Thit's my ...
1
vote
0answers
71 views
Is Snort able to efficiently demux and log large HTTP POST requests?
I'm trying to debug some failed HTTP POST requests containing large file uploads (~500 MB). The end-user is receiving strange HTTP responses that are not being logged in either varnish's varnishncsa ...
1
vote
0answers
86 views
Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging
With log_syslog_full opertion mode set to complete you get the below output.
Can some explain to me what the bold parts are? I have been searching and cannot find any documention explaining the new ...
1
vote
2answers
174 views
how can a mirror all of the traffic on a network interface, to virtual interface
I am trying to setup snort to act as an ids, on a debian machine that also functions as a router. Ideally I would like to setup snort in such a way so that I would not have to purchase an additional ...
2
votes
0answers
86 views
Configuring Barnyard2 Output Plug-In Per Input Source
I am currently using snort-2.9.3.1 outputting unified2 log format and using barnyard2-1.9 to process the alerts and send them to both syslog and a database. In some cases I have multiple instances of ...
1
vote
0answers
295 views
Ubuntu 12.04 Server snort 2.9.2.3 not logging NMAP Scans after first VTR Rules update
I install snort 2.9.2.3 from the Ubuntu repositories along with Oinkmaster. I'm not running LAMP just snort for logging pcap and to the alert log file.
Out of the box installation snort worked. ...
0
votes
1answer
156 views
snort-mysql not starting on Ubuntu server
I am following this tutorial: https://help.ubuntu.com/community/SnortIDS
I've set up the database, everything has installed correctly, and I've configured the snort.conf file so it outputs to a ...
0
votes
0answers
51 views
How ping out Snorby interface in ubuntu? [closed]
can i get know how run out the snorby interface.
I'm a trainee n learning on it but my superior asking the way to ping out the snorby interface.
i wil glad if get some help on it.
1
vote
1answer
1k views
Tuning Snort Rules: COMMUNITY SIP TCP/IP message flooding directed to SIP proxy
This is a common problem in Snort, but I'm not sure why the rule triggers at all.
The rule below comes from the Debian repositories. Apparently it is designed to trigger when there are more than ...
2
votes
1answer
37 views
POLICY Mozilla Multiple Products HTML href shell attempt - SNORT
We've had a few of these alerts get triggered through Snort:
"POLICY Mozilla Multiple Products HTML href shell attempt"
I'm struggling to find any information pertaining to this alert, does anyone ...
0
votes
1answer
131 views
snort intrusion detection
Hi im trying to use snort as an IDS on some pcap files I have, I was hoping I would get a log of any intrusions. I know for a fact that there is port scans and ping sweeps etc in the pcap files but ...
1
vote
1answer
440 views
Snort/Barnyard2 Logging
I need some help with my Snort/Barnyard2 setup. My goal is to have Snort send unified2 logs to Barnyard2 and then have Barnyard2 send the data to other locations. Here is my currrent setup.
OS
...
2
votes
0answers
102 views
Implications of unified2 logging with multiple instances of snort
I am beginning to migrate my snort logging from alert_syslog to unified2 using barnyard2 as the processor. In some cases I have multiple instances of snort running on the same system. Since I have ...
0
votes
1answer
231 views
Snort: not logging anything
My site seems to be the target of quite a bit of probing over the last few months. In an attempt to get a better handle on this I installed SNORT on one of the machines that has external exposure. ...
-2
votes
1answer
245 views
Remote logging from snort to rsyslog
As part of a school project, we are supposed to run snort on a Ubuntu server in IDS mode and log the packets to rsyslog on a remote Ubuntu server. I have been searching for manuals/tutorials for a ...
2
votes
1answer
448 views
snort not logging full output to syslog
I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
-4
votes
2answers
216 views
Portscan attacks from somewhere
I realize this is a lamer/beginner question, but I've been attacked by a couple of addresses in China and I'm not sure how to close the hole.
My snort logs (yes I'm using snort! I see you are ...
0
votes
0answers
100 views
Sniffing Email Address with Snort
I am new to snort rules and need a rule that will alert any email from a specific user.. For example:
alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"email@thatemail.com"; ...
3
votes
2answers
278 views
specifying snort output files?
I'm confused about snort outputs. Where are the output file(s) supposed to be specified?
OR, more specifically, I've got two files being written (alert and snort.log.xxx), but only have one output ...
2
votes
1answer
699 views
Centos KVM Host OS not passing all network traffic Guest OS
I'm running KVM on Centos 5. I have a guest OS, ubuntu 10.04, that has Snort 2.9 installed on it. The guest OS has (2) nic's, eth0 and eth1. One nic, eth0, is configured with an IP and can be ...
0
votes
1answer
185 views
How can I detect DNS label Decoding DoS (Cross Reference at DNS decompression) with Snort?
I want to add some rules or download some ready rules to detect DNS label Decoding DoS (Cross Reference at DNS decompression) can anyone know how can I do this?
1
vote
2answers
1k views
Snort [PFSense] is configured but not blocking or generating alerts!
I've got PFSense V 2.0-RC1 (i386) and I've got the latest version of Snort installed
I've loaded up a bunch of rules from Oinkmaster, I've enabled all of the preprocessors, and I've ensured the ...
4
votes
2answers
499 views
Is there an appliance-style distribution with web-based configuration for Snort?
There are some great "appliance" style distributions like pfSense and M0n0wall, that bundle powerful features of their respective operating systems with a nice web application for configuration. In my ...
1
vote
0answers
52 views
snort not alerting on rule if IE is used
Hi
I have snort rules to alert for specific host name and URL.
when I tested I see that snort is not alerting if I use internet explorer 8, but alerting if i use firefox and safari
after analysis , i ...
0
votes
1answer
215 views
how to do fragmentation attack via ubuntu machine
I wish to test my system which has snort installed on it.
I want to do fragmentation attack such as tiny fragment attack and wish that it should be logged by snort.
any suggestions? any graphical ...
0
votes
1answer
161 views
Snort Excluding Multiple Ports From ShellCode rules
How can I specify mutliple ports to exclude from shellcode rules? I'm using the latest version of snort. I'm also interested in knowing which ports should generally be excluded.
2
votes
2answers
471 views
Custom Rules for Snort
I need to allow certain traffic through which is being blocked by snort eg ICMP from a specific address. How can I do this?
0
votes
1answer
226 views
My snort graphs have no words
I just got Security+ certified and stared to care about my network (or use my newly aquired knowledge to make everything better)
I just installed Snort the open source IDS. I am having one issue ...
0
votes
2answers
531 views
11
votes
2answers
478 views
Snort Performance Monitoring
Using snort version 2.8.6, I am attempting to collect application performance stats such as
Number of packets not processed due to application overload
Percentage of time in processing layers ...
7
votes
2answers
1k views
snort analysis of wireshark capture
I'm trying to identify trouble users on our network. ntop identifies high traffic and high connection users, but malware doesn't always need high bandwidth to really mess things up. So I am trying ...
2
votes
1answer
225 views
Are random packets normal?
About a month ago on one of my servers I started receiving random packets from IPs all over the world. So I did the smart thing and stopped putting off installing an IDS. This IDS is a ClearOS Gateway ...
1
vote
1answer
337 views
Snort monitoring of spanning interface
I have configured a Cisco 3500 switch with a port SPAN and have my snort node (fedora 13) plugged into it. I am running snort as a daemon and have configured a rule to log all tcp traffic but I am ...
0
votes
1answer
1k views
Problems with ACID / BASE interface for SNORT IDS on remote host
I've just installed SNORT and ACID/BASE following this step by step tutorial: https://help.ubuntu.com/community/SnortIDS on a remote Debian host over SSH. The main difference being that I have already ...
0
votes
1answer
82 views
snort fedora core x86_64 rules
Does anyone know if where I can download the snort rules for Fedora Core 13 x86_64 not i386, if they even exist?
Thanks
0
votes
3answers
293 views
Extremely Large MySQL Data sets
I'm running Snort in conjunction with MySQL for logging, which is generating ENORMOUS datasets (currently the event table is over 2.5 million, I don't know exactly how much because it only goes up to ...
1
vote
1answer
5k views
Snort rules for syn flood / ddos?
Can someone provide me rules to detect following attack :
hping3 -S -p 80 --flood --rand-source [target]
I'm having problem with rules since packet comes from random source.
My current rules is : ...
1
vote
1answer
599 views
Iptables QUEUE Target and Snort
I'm trying to set up a firewall with support for snort, and it is dropping all of my packets when I add the QUEUE target. I've made it like this, but the QUEUE target is not allowing the packets to be ...
0
votes
1answer
156 views
Where is the location of snort.conf
Dear all
I've installed Snort, but can't find the snort.conf file in both /ect/ and /usr/local/ (and don't have snort directory in these location as well)
Do you know where's the snort.conf
My version ...
