Questions tagged [snort]
Snort is a software package used for network intrusion detection.
5
questions
-4
votes
2
answers
816
views
Portscan attacks from somewhere
I realize this is a lamer/beginner question, but I've been attacked by a couple of addresses in China and I'm not sure how to close the hole.
My snort logs (yes I'm using snort! I see you are ...
- 798
5
votes
1
answer
3k
views
How can I run a shell script on a snort alert?
I have snort listening to the SPAN port of a cisco switch. I'd like to be able to add an iptables DROP rule on my webserver for specific snort alerts but having a hard time finding out exactly how to ...
- 3,784
2
votes
1
answer
2k
views
snort not logging full output to syslog
I am able to send snort alerts to my remote syslog server but I am not able to see full alert message; I only see basic information like title, source and destination IP. I am specifically interested ...
- 21
2
votes
3
answers
6k
views
Snort not detecting outgoing traffic
I'm using Snort 2.9 on windows server 2008 R2 x64, with a very simple configuration that goes like this:
# Entire content of Snort.conf:
alert tcp any any -> any any (sid:5000000; content:"...
- 229
1
vote
1
answer
3k
views
How to set Suricata to log only DNS queries that come from specific IP addresses?
I am new to working with IDS' such as Suricata/Snort. I am currently trying to using Suricata to log DNS requests and responses to malicious domains on my network. On my DNS server I made it so that ...
- 133