Snort is a software package used for network intrusion detection.

learn more… | top users | synonyms

0
votes
0answers
18 views

Snort Windows inline mode

I'm setting up Snort on Windows. I can test the inline mode but when I try to put it in inline mode so I can drop instead of alert. When I try to use the DAQ modules (afpacket) it says it can't find ...
0
votes
0answers
11 views

Configuration snort IDS

I have installed snort on my windows 7 machine. But during configuration of snort, it gives me the following error. ERROR: c:\Snort\etc\c:\Snort\rules\app-detect.rules(0> Unable to open rules ...
0
votes
1answer
17 views

Snort looking for invalid rules directory

I am in the middle of setting ups snort for the first time on Fedora 23. I have configured pulledpork for auto rules download. As you can see from the picture below, the test to see if pulledpork has ...
0
votes
0answers
17 views

Is it possible to monitor all 24 switch ports on a span port? (for snort / NIDS monitoring)

This isn't possible on the switch we have now (you can monitor at most 4 ports in full duplex, or 8 ports in half-duplex). I'm wondering if there is hardware out there that allows you to monitor all ...
0
votes
1answer
83 views

suricata TLS rule not ignoring my “pass” entry

I'm using this rule to skip suricata tls processing on a known SSL cert: pass tls any any <> any any (msg:"known good mydomain cert"; tls.fingerprint:"40:.(trimmed for serverfault).:8b"; ...
1
vote
1answer
85 views

Why doesn't Snort match on DNS response?

This is likely a beginner's misunderstanding. System is: Ubuntu AMD64, 14.04.03 LTS; installed Snort with default configuration. I am writing a Snort rule that deals with DNS responses. In order to ...
-1
votes
1answer
88 views

barnyard2 for snort permission denied

I installed barnyard2 for snort, but when i run command below this error appear. [root@localhost snort]# barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort.log -w ...
0
votes
0answers
130 views

Running Snort on ppp0 / VPN Virtural Interface

I've been attempting to get Snort Version 2.9.7.5 GRE (Build 262) work with interface ppp0 (VPN) which is a virtual interface. After digging Google for several hours I discovered that there was a ...
0
votes
1answer
222 views

Snort: users are not able to login when Wordpress Login Bruteforcing rule is on

I got this wordpress login bruteforcing rule from https://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-web_server.rules alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS ...
1
vote
1answer
56 views

Is it possible to use syslog-ng to forward logs to SecurityOnion ELSA?

I have installed Snort IDS and syslog-ng on my VM, and I want to use syslog-ng to forward my logs to another vm which is SecurityOnion. So I want to know can syslog-ng forward logs to ELSA which is in ...
0
votes
1answer
213 views

PFSense / Snort / OpenVPN - one WAN interface

I have a pfsense box running both Snort and OpenVPN. The VPN worked great before installing Snort, now intermittently I cannot connect. Should I whitelist the port that the VPN uses on the WAN ...
0
votes
0answers
113 views

Deploying latest snort release with ansible

I'm like to be able to automatically deploy snort with ansible, but snort removes old RPMs when new ones are released so I have to adjust my playbook with each new release. I'd really like to be ...
0
votes
1answer
43 views

SNORT: Is a PCRE on SSNs intensive

I'm trying to write a Snort rule to look for SSNs. Due to the limitations of the appliance in place I can not use the pre-processor settings. How intense would it be to run a PCRE rule for SSNs? ...
0
votes
1answer
64 views

How to use Snort generate packet logs when in the NIDS mode?

I am using Snort act like a network IDS by implementing snort configuration file and snort rules, I also want to capture all the packets (traffic) going through the specific network interface. My ...
1
vote
2answers
246 views

How can I put snort in front of nginx server

I want to prevent attacks to my nginx server. How can I proxy the requests through snort to nginx server. NFQueue's are a solution.I am able to pass packets to snort using the following rules sudo ...
1
vote
2answers
669 views

Trouble Starting Snorby / Ruby dependency issue

I am trying to install Snorby on a CentOS 6.6 machine and keep getting an issue with ruby and my Gemfile. I believe I either have to edit my Gemfile or it has something to do with an installation ...
0
votes
1answer
273 views

Snort IDS on HAproxy with encrypted traffic

Using HAproxy, can I direct traffic to a backend server from all the other backend servers in a pool? From a networking standpoint, it would be comparable to mirroring all ports on a switch to one ...
0
votes
0answers
119 views

snort rule: SENSITIVE-DATA Email Addresses

I already asked this on the snort-users mailinglist but seemingly the question is ignored there. So maybe with some snort preprocessors can help me here. I get alot of false positives when browsing ...
3
votes
0answers
352 views

How do iptables work with NFQ in terms of traffic shaping in snort?

I'm trying to understand how iptables and NFQ work together with snort. The reason that I ask this is because from what I understand snort can be set to IPS via NFQ but if you have iptables there ...
2
votes
1answer
4k views

snort: drop icmp rule doesn't actually drop packets

I installed snort-2.9.7 from sources, and launch as IDS: % snort -devQ -A console -c /etc/snort/snort.conf -i eth0:eth1 Enabling inline operation Running in IDS mode ... The config file is very ...
1
vote
1answer
1k views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ...
0
votes
1answer
83 views

SNORT only alerting on inbound traffic

I am trying to raise an alert when someone is setting up a connection to PORT 25 (tcp), whatever source or destination. For this i came up with this simple rule: alert tcp any any -> any 25 ...
1
vote
2answers
4k views

Snort: Unable to open rules file

This is my first with snort. And I can't get it to run. I followed this tutorial exactly. And I have fedora 21. Here's the output from snort -c /etc/snort/snort.conf -v -i enp0s3: Running in IDS ...
0
votes
2answers
102 views

is there a way from iptables/iproute to forward all traffic to my IDS and also keep the regular flow

The reason of this, is that to catch all packages into my IDS keeping my existing enviroment, so the IDS does not become a single point of failure. If route all my traffic into my IDS and from my IDS ...
-2
votes
1answer
402 views

VirtualBox Networking Lab Configuration [closed]

I'm creating a lab for a project that will test a network security defense product's effectiveness in detecting various attacks. I have a physical server with 32GB of RAM and VirtualBox to create the ...
0
votes
1answer
257 views

Snort in KVM machines

I have installed two physical machines with KVM virtualization using Red hat as OS ( h1 and h2). In h1 I have installed the virtual machines w1 and db1 and in h2 the virtual machines w2 , db1 and ids. ...
3
votes
1answer
652 views

How can I run a shell script on a snort alert?

I have snort listening to the SPAN port of a cisco switch. I'd like to be able to add an iptables DROP rule on my webserver for specific snort alerts but having a hard time finding out exactly how to ...
1
vote
0answers
708 views

Barnyard2 error on start

Been setting up a snort box with barnyard2, run into the error below. Can someone please help? $Starting Snort Output Processor (barnyard2): ./barnyard2: 35: ./barnyard2: barnyard2: not found ...
0
votes
1answer
457 views

Running snort behind iptables

I run a Centos 6.5 server with a highly restrictive iptables ruleset allowing incoming traffic only on a small handful of tcp ports (8 in total) and blocks all incoming unsolicited UDP traffic. I ...
1
vote
1answer
4k views

Snort not sending alert log file to syslog server?

I am set up with three virtual machines running Ubuntu - a Server, Client, and Gateway. I am tasked with setting up Snort on the Gateway to monitor "attacks" from the Client to the Server. Snort is ...
0
votes
1answer
761 views

setting up snort 2.9.x with barnyard2

These how to guides on the interent are outdated also the software it is relying on is not up to date with PHP5.5. I have done some hacks with ACID and ADODB to make part sof the gui to work. I have ...
0
votes
1answer
494 views

flowbits in snort added because of quality standard

I'm having trouble reading a rule. Specifically, where is a flowbits GROUP_NAME defined? I was reviewing my squert screens from securityonion and noticed the following: 3618 ET TROJAN Backdoor ...
1
vote
0answers
241 views

configure frag3 in SNORT

i m trying to test IDS systems on evasion. I have picked up Snort IDS. I have crafted few fragmented packet scenario, and i m sending those fragmented packet to destination address. All these crafted ...
0
votes
2answers
3k views

Why do my Snort logs appear to be empty?

So I was following this guide on how to install Snort, Barnyard 2 and the like. I've set up Snort so it would run automatically, by editing the rc.local file: ifconfig eth1 up ...
0
votes
1answer
643 views

Running Snort on Hyper-V

After spinning up a VM for Snort (actually BT5..) and starting snort, I'm getting numerous "SNMP Public Access udp [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} ...
0
votes
1answer
231 views

Snort logging mode - How to define subnets

I am using snort to log all traffic on an interface snort -i eth1 -l /interface/log/dir -b -U -m 112 With this command I manage to get ALL data which makes my log files very large. Is there any ...
1
vote
0answers
66 views

Can IPtables (possibly with libnetfilter_queue library) do everything that snort does?

I have just started getting into network security, firewall, etc. So, please excuse me for asking this basic question. I looked at IPtables and got a good hang of it (nowhere close to becoming an ...
0
votes
2answers
253 views

How do I set Securityonion/snort to not capture certain packets?

After looking through my pcaps from Security onion I'd like to filter out a host (let's call it 192.168.4.4) and filter out some traffic (ports 80 & 443), current project is to look at other ...
1
vote
3answers
1k views

Snort not detecting outgoing traffic

I'm using Snort 2.9 on windows server 2008 R2 x64, with a very simple configuration that goes like this: # Entire content of Snort.conf: alert tcp any any -> any any (sid:5000000; ...
1
vote
1answer
541 views

Snort, Portscans and Scanned IP Range field

According to manual.snort.org, TCP Portscans goes from one computer to other one, but when you take a look to an tcp portscan alert in snort/snorby you can see this: In one hand: Source: ...
0
votes
1answer
193 views

Snort configuration

I'm trying to configure Snort on a security probe and I am having an error: FATAL ERROR: database: mysql_error: Can't connect on MYSQL server on "x" (111). I have set up the account with privileges ...
0
votes
1answer
1k views

Should I Install Snort on my web server? [closed]

I've been thinking about installing snort on my dedicated server. I got about 100 domains/clients. What should I be considering here for pros and cons? Memory usage, bandwidth impact?
1
vote
1answer
22 views

Monitor a machine plugged on a mirroring interface

I've read that if I configure port span, I can no longer use that interface to pass normal trafic. However, I'd like to monitor the machine plugged to that interface, with nagios.. Does anyone know ...
0
votes
2answers
870 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
0
votes
1answer
818 views

OSSIM Alarms for Snort rules

I'm new to OSSIM. My requirement is to detect executable files (.exe) using snort. I have found a snort rule: alert tcp any any -> any any (msg: "DLL Windows file download"; flow: established; ...
1
vote
2answers
2k views

pfSense and Snort: unexpected portscan traffic on interface

I have a pfSense box acting as my public facing router and stateful firewall. There is 1 WAN interface and several LAN interfaces using private IPs behind NAT. I EXPECT to see portscans or all kinds ...
2
votes
3answers
2k views

Snort Based Firewall

I have not worked with SNORT much or done too much research on this but it sounds possible. If I setup a server and run snort on it. Would it then be possible to route ALL my traffic through it like ...
0
votes
1answer
215 views

Using Snort without a port mirrored switch

I am trying to set up a Snort IDS on a virtual machine for my lab. My problem is that normally, these kinds of IDS are connected to the mirrored port of a switch. My lab has no such device. Here is my ...
1
vote
1answer
208 views

What class of software should I use to intercept HTTP requests and perform an action

We have inherited an old Web application that needs to be extended with some logging capacities for compliance purposes. Unfortunately, we can't change the application. The application receives XML ...
1
vote
0answers
163 views

Is Snort able to efficiently demux and log large HTTP POST requests?

I'm trying to debug some failed HTTP POST requests containing large file uploads (~500 MB). The end-user is receiving strange HTTP responses that are not being logged in either varnish's varnishncsa ...