Snort is a software package used for network intrusion detection.

learn more… | top users | synonyms

0
votes
0answers
88 views
+50

Snort not sending alert log file to syslog server?

I am set up with three virtual machines running Ubuntu - a Server, Client, and Gateway. I am tasked with setting up Snort on the Gateway to monitor "attacks" from the Client to the Server. Snort is ...
0
votes
0answers
15 views

Windows Snort remote MSSQL

I have to setup snort on a Windows 2012 machine. Snort works fine. However, I am supposed to write all logs to a Microsoft Database Server 2012 on a different VM. However, at the moment I cannot ...
0
votes
1answer
107 views

setting up snort 2.9.x with barnyard2

These how to guides on the interent are outdated also the software it is relying on is not up to date with PHP5.5. I have done some hacks with ACID and ADODB to make part sof the gui to work. I have ...
0
votes
0answers
65 views

flowbits in snort added because of quality standard

I'm having trouble reading a rule. Specifically, where is a flowbits GROUP_NAME defined? I was reviewing my squert screens from securityonion and noticed the following: 3618 ET TROJAN Backdoor ...
0
votes
0answers
61 views

How to write Snort rules for GET requests coming from pcap files with specific string pattern

I would appreciate if the community help me with the snort rules for HTTP get requests. For example, lets say you notice in the attack GET requests, they all have "...destroy=True&..." but NONE of ...
0
votes
0answers
161 views

Snort logs empty after attack

So, referring to my old thread, where I was unable to log anything, I did some asking and searching around. There's still no solution to the problem, but what I'm doing right now is this: What I did ...
1
vote
0answers
44 views

configure frag3 in SNORT

i m trying to test IDS systems on evasion. I have picked up Snort IDS. I have crafted few fragmented packet scenario, and i m sending those fragmented packet to destination address. All these crafted ...
0
votes
1answer
381 views

Why do my Snort logs appear to be empty?

So I was following this guide on how to install Snort, Barnyard 2 and the like. I've set up Snort so it would run automatically, by editing the rc.local file: ifconfig eth1 up ...
0
votes
1answer
193 views

Running Snort on Hyper-V

After spinning up a VM for Snort (actually BT5..) and starting snort, I'm getting numerous "SNMP Public Access udp [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} ...
0
votes
0answers
116 views

Snort 2.9.2 doesn't see local network traffic any more

I installed Snort 2.9.2 + ACID BASE + Postgresql on Ubuntu Server LTS 12.04 about 5 month ago. Snort host have local IP address 10.0.40.3/24. There is a some hosts in 10.0.40.0 network. After ...
0
votes
1answer
59 views

Snort logging mode - How to define subnets

I am using snort to log all traffic on an interface snort -i eth1 -l /interface/log/dir -b -U -m 112 With this command I manage to get ALL data which makes my log files very large. Is there any ...
1
vote
0answers
46 views

Can IPtables (possibly with libnetfilter_queue library) do everything that snort does?

I have just started getting into network security, firewall, etc. So, please excuse me for asking this basic question. I looked at IPtables and got a good hang of it (nowhere close to becoming an ...
0
votes
2answers
98 views

How do I set Securityonion/snort to not capture certain packets?

After looking through my pcaps from Security onion I'd like to filter out a host (let's call it 192.168.4.4) and filter out some traffic (ports 80 & 443), current project is to look at other ...
0
votes
0answers
51 views

snort is not alerting to a web console

I am configuring snort in OSSIM, modified the snort.debian.conf and when I check the status it gives OK. But it is not logging as I have checked the file. How can I get the alerts logged and on the ...
0
votes
0answers
279 views

Snort configuration in OSSIM

I am working on snort, the one built-in with OSSIM. I am trying to configure it to get the alerts on ossim web-interface but I am unable to even start it properly. I am using 1 NIC although have ...
1
vote
3answers
302 views

Snort not detecting outgoing traffic

I'm using Snort 2.9 on windows server 2008 R2 x64, with a very simple configuration that goes like this: # Entire content of Snort.conf: alert tcp any any -> any any (sid:5000000; ...
0
votes
0answers
331 views

Installing and configuring Snort, Barnyard2 on ubuntu 13.10 server 64 bit in AWS EC2 VPC

I need you help after searching a whole lot and asking AWS my problem is not getting resolved, so I have come here for your help. I have a AWS VPC setup with all ubuntu servers I have a NAT server ...
0
votes
0answers
141 views

Barnyard2 output log_syslog_full

I am trying to get barnyard2 to take the unified2 output from snort and send a full syslog message to localhost but I cant seem to get it to work: I am looking for a syslog message with as much ...
1
vote
1answer
215 views

Snort, Portscans and Scanned IP Range field

According to manual.snort.org, TCP Portscans goes from one computer to other one, but when you take a look to an tcp portscan alert in snort/snorby you can see this: In one hand: Source: ...
0
votes
1answer
92 views

Snort configuration

I'm trying to configure Snort on a security probe and I am having an error: FATAL ERROR: database: mysql_error: Can't connect on MYSQL server on "x" (111). I have set up the account with privileges ...
0
votes
1answer
424 views

Should I Install Snort on my web server? [closed]

I've been thinking about installing snort on my dedicated server. I got about 100 domains/clients. What should I be considering here for pros and cons? Memory usage, bandwidth impact?
1
vote
1answer
19 views

Monitor a machine plugged on a mirroring interface

I've read that if I configure port span, I can no longer use that interface to pass normal trafic. However, I'd like to monitor the machine plugged to that interface, with nagios.. Does anyone know ...
0
votes
2answers
506 views

How to properly drop ICMP type 3 packets on possible DDoS attack?

Even after running iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like: 19:41:31.923630 IP ...
0
votes
1answer
323 views

OSSIM Alarms for Snort rules

I'm new to OSSIM. My requirement is to detect executable files (.exe) using snort. I have found a snort rule: alert tcp any any -> any any (msg: "DLL Windows file download"; flow: established; ...
1
vote
2answers
646 views

pfSense and Snort: unexpected portscan traffic on interface

I have a pfSense box acting as my public facing router and stateful firewall. There is 1 WAN interface and several LAN interfaces using private IPs behind NAT. I EXPECT to see portscans or all kinds ...
2
votes
3answers
699 views

Snort Based Firewall

I have not worked with SNORT much or done too much research on this but it sounds possible. If I setup a server and run snort on it. Would it then be possible to route ALL my traffic through it like ...
0
votes
1answer
151 views

Using Snort without a port mirrored switch

I am trying to set up a Snort IDS on a virtual machine for my lab. My problem is that normally, these kinds of IDS are connected to the mirrored port of a switch. My lab has no such device. Here is my ...
1
vote
1answer
159 views

What class of software should I use to intercept HTTP requests and perform an action

We have inherited an old Web application that needs to be extended with some logging capacities for compliance purposes. Unfortunately, we can't change the application. The application receives XML ...
1
vote
0answers
130 views

Is Snort able to efficiently demux and log large HTTP POST requests?

I'm trying to debug some failed HTTP POST requests containing large file uploads (~500 MB). The end-user is receiving strange HTTP responses that are not being logged in either varnish's varnishncsa ...
1
vote
0answers
200 views

Snort/Barnyard2-1.10 LOG_SYSLOG_FULL Output Logging

With log_syslog_full opertion mode set to complete you get the below output. Can some explain to me what the bold parts are? I have been searching and cannot find any documention explaining the new ...
1
vote
2answers
423 views

how can a mirror all of the traffic on a network interface, to virtual interface

I am trying to setup snort to act as an ids, on a debian machine that also functions as a router. Ideally I would like to setup snort in such a way so that I would not have to purchase an additional ...
2
votes
0answers
106 views

Configuring Barnyard2 Output Plug-In Per Input Source

I am currently using snort-2.9.3.1 outputting unified2 log format and using barnyard2-1.9 to process the alerts and send them to both syslog and a database. In some cases I have multiple instances of ...
1
vote
0answers
453 views

Ubuntu 12.04 Server snort 2.9.2.3 not logging NMAP Scans after first VTR Rules update

I install snort 2.9.2.3 from the Ubuntu repositories along with Oinkmaster. I'm not running LAMP just snort for logging pcap and to the alert log file. Out of the box installation snort worked. ...
0
votes
2answers
449 views

snort-mysql not starting on Ubuntu server

I am following this tutorial: https://help.ubuntu.com/community/SnortIDS I've set up the database, everything has installed correctly, and I've configured the snort.conf file so it outputs to a ...
1
vote
1answer
3k views

Tuning Snort Rules: COMMUNITY SIP TCP/IP message flooding directed to SIP proxy

This is a common problem in Snort, but I'm not sure why the rule triggers at all. The rule below comes from the Debian repositories. Apparently it is designed to trigger when there are more than ...
2
votes
1answer
51 views

POLICY Mozilla Multiple Products HTML href shell attempt - SNORT

We've had a few of these alerts get triggered through Snort: "POLICY Mozilla Multiple Products HTML href shell attempt" I'm struggling to find any information pertaining to this alert, does anyone ...
0
votes
1answer
265 views

snort intrusion detection

Hi im trying to use snort as an IDS on some pcap files I have, I was hoping I would get a log of any intrusions. I know for a fact that there is port scans and ping sweeps etc in the pcap files but ...
2
votes
1answer
1k views

Snort/Barnyard2 Logging

I need some help with my Snort/Barnyard2 setup. My goal is to have Snort send unified2 logs to Barnyard2 and then have Barnyard2 send the data to other locations. Here is my currrent setup. OS ...
2
votes
0answers
173 views

Implications of unified2 logging with multiple instances of snort

I am beginning to migrate my snort logging from alert_syslog to unified2 using barnyard2 as the processor. In some cases I have multiple instances of snort running on the same system. Since I have ...
0
votes
1answer
655 views

Snort: not logging anything

My site seems to be the target of quite a bit of probing over the last few months. In an attempt to get a better handle on this I installed SNORT on one of the machines that has external exposure. ...
-1
votes
1answer
360 views

Remote logging from snort to rsyslog

As part of a school project, we are supposed to run snort on a Ubuntu server in IDS mode and log the packets to rsyslog on a remote Ubuntu server. I have been searching for manuals/tutorials for a ...
2
votes
1answer
851 views

snort not logging full output to syslog

I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
-4
votes
2answers
366 views

Portscan attacks from somewhere

I realize this is a lamer/beginner question, but I've been attacked by a couple of addresses in China and I'm not sure how to close the hole. My snort logs (yes I'm using snort! I see you are ...
3
votes
2answers
1k views

specifying snort output files?

I'm confused about snort outputs. Where are the output file(s) supposed to be specified? OR, more specifically, I've got two files being written (alert and snort.log.xxx), but only have one output ...
2
votes
2answers
2k views

Centos KVM Host OS not passing all network traffic Guest OS

I'm running KVM on Centos 5. I have a guest OS, ubuntu 10.04, that has Snort 2.9 installed on it. The guest OS has (2) nic's, eth0 and eth1. One nic, eth0, is configured with an IP and can be ...
0
votes
1answer
291 views

How can I detect DNS label Decoding DoS (Cross Reference at DNS decompression) with Snort?

I want to add some rules or download some ready rules to detect DNS label Decoding DoS (Cross Reference at DNS decompression) can anyone know how can I do this?
1
vote
2answers
2k views

Snort [PFSense] is configured but not blocking or generating alerts!

I've got PFSense V 2.0-RC1 (i386) and I've got the latest version of Snort installed I've loaded up a bunch of rules from Oinkmaster, I've enabled all of the preprocessors, and I've ensured the ...
4
votes
2answers
1k views

Is there an appliance-style distribution with web-based configuration for Snort? [closed]

There are some great "appliance" style distributions like pfSense and M0n0wall, that bundle powerful features of their respective operating systems with a nice web application for configuration. In my ...
1
vote
0answers
60 views

snort not alerting on rule if IE is used

Hi I have snort rules to alert for specific host name and URL. when I tested I see that snort is not alerting if I use internet explorer 8, but alerting if i use firefox and safari after analysis , i ...
0
votes
1answer
301 views

how to do fragmentation attack via ubuntu machine

I wish to test my system which has snort installed on it. I want to do fragmentation attack such as tiny fragment attack and wish that it should be logged by snort. any suggestions? any graphical ...