Questions tagged [snort]

Snort is a software package used for network intrusion detection.

Filter by
Sorted by
Tagged with
0
votes
0answers
8 views

snort: failing to trigger a rule with uricontent and content fields

I'm playing with snort to understand rules and I'm trying to trigger the following rule: alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PHP PhpGedView PGV base directory ...
0
votes
0answers
11 views

How to disable specific preprocessor checks in Snort 3

I want to disable certain preprocessor check options in Snort 3. For the sake of specificity, let's limit this discussion to SSH preprocessor options. The configuration options for the Snort 2 SSH ...
0
votes
0answers
20 views

How to reliably block sensitive content on twitter?

Since the introduction of twitters content policy, possibly sensitive content is marked and users have to skip the warning to actually see the tweet. Is there a way to block possibly sensitive tweets ...
0
votes
1answer
33 views

Using tc filter together with Snort

I need to add delay to packets after doing some modification using the SNORT inline module. However, I cannot seem to get the packets to match a filter using tc filter ... It always matches the ...
0
votes
0answers
13 views

New snort Install

I just downloaded and install CentoOS 8 and installed Snort 2.9.15 and the config file checks out but the snortd services cannot start as the file is missing. I did a find and found snortd under ...
0
votes
0answers
326 views

suricata ips mode configuration

I installed Suricata and Shorewall on device with 3 NIC and a wifi card, I wanted to configure Suricata as IPS. I followed several instructions both from the manual and from several blogs. I have ...
0
votes
0answers
8 views

Snort controller from outer server-machine

I have a Flask server on one computer, and I've installed Snort in order to monitor the whole network (a few computers) on another computer. Is there a known method\API for controlling (start\stop\...
11
votes
1answer
533 views

Snort is receiving traffic, but doesn't appear to be applying rules

I have snort installed and running in inline mode via NFQUEUE on my local (as in I can walk in the next room and touch it) gateway. I have the following rule in my /etc/snort/rules/snort.rules: alert ...
0
votes
0answers
40 views

Import python code into SNORT v 2.9.13 as a dynamic preprocessor

I am trying to load a custom made Neural Network classifier that I wrote in Python into Snort as a dynamic preprocessor. As I have seen till now, Snort only uses C code for its preprocessors and I ...
0
votes
1answer
198 views

Ubuntu 18.04 snort protection

Recently I installed Snort on my Ubuntu server 18.04 And also wrote some rules in local.rules . it will perfectly detect my rules like ping , simple dos attacks etc. I have 4 questions : How can i ...
0
votes
0answers
33 views

Use Snort 2.9 rules for Snort 2.8.6

Unfortunately Snort doesn't release rules update 2.8.6 since 2017. All customer should upgrade to 2.9. But 2.9 is X64 and my OS is Fedora X86. I need to update my Snort 2.8.6 signatures. Is there any ...
1
vote
0answers
63 views

Suricata: Error opening file threshold.config

I use Suricata 4.0.5 (an open source IDPS) on windows server 2012. It raises the below error when I run it, however, it runs. Error opening file threshold.config I searched for this error and find ...
2
votes
0answers
506 views

Suricata logs “A Network Trojan was detected”. Is it false positive?

I use the Suricata as IDS on the local network that it doesn't the internet. It logged a few alerts from some clients that said A Network Trojan was detected. All log's properties are in the following:...
1
vote
1answer
1k views

Suspicious DNS query leads to “Intrusion protection alert” on Sophos UTM

A customer Sophos-UTM reports Intrusion protection alert warnings INDICATOR-COMPROMISE suspicious .null dns query: 2019:01:15-11:54:13 utm-ba snort[31619]: id="2101" severity="warn" sys="SecureNet" ...
1
vote
0answers
150 views

Snort for Windows - how to get payload info out to log file, for later analysis?

I am running Snort v2.9.12 for Windows. I am getting (via -d option) payload information on console, but it is not going out to the Snort log file. I am only getting the header information. I modify ...
1
vote
1answer
345 views

Snort not sniffing any traffic except it's own

I'm currently trying to set up Snort on my local machine. At the moment I have 3 VM's: 1 with snort on it and 2 used to ping eachother. Whenever I ping from one of the devices to the Snort-machine, ...
1
vote
0answers
142 views

Snort not dropping packets

as we want to protect our network from malicious traffic we think about setting up snort on our routers. For test reasons I built a system to replicate the network architecture consisting of my host ...
0
votes
0answers
88 views

running snort and IGMP v2 flooding

I am not a network guru so please bear with me. I am running snort on a PLC (running rt-linux) along with an application that needs to communicate with another instance of the same application ...
1
vote
1answer
2k views

Suricata, Docker, and host networking: No non-docker traffic

I've created a docker container with Suricata and Evebox on it. On my host I start with: ifconfig enp2s0:1 192.168.0.111 netmask 255.255.255.0 up This sets up a new interface off my existing one. I ...
0
votes
0answers
141 views

Making post alert script for snort

I`m trying to make a script that trigger an action if 5 snort rules ware broken in 24 hours interval. I`m putting all my snort logs in alert.log Can some one help me to make a script that motor this ...
0
votes
1answer
218 views

Any way to save Suricata alert payload?

I've followed some directions for setting up Graylog and Snort (I used Suricata however) here but it would be nice to be able to see what the Alert payload was which generated the event. An ...
0
votes
1answer
2k views

snort rule for rdp dos attack

i am very new in snort rules so i can't find the below rule exactly . is this rule send alert when tcp packets come from external network and any port to home network and port 3389? just check port , ...
-1
votes
1answer
438 views

specify the order of IDS , Firewall , WAF

i have an ubuntu system and i want to implement iptables as firewall, modsecurity as WAF and snort as IDS in this system and i have a server behind this system and i want to protect the server with ...
0
votes
1answer
260 views

Snort and OSSEC Can't Run Simultaneously

I am trying to set up IDS on a system composed of AWS Ubuntu 16.04 instances. My HIDS is managed by OSSEC 2.8.1 and my NIDS is managed by Snort 2.9.9.0 (parsed by Barnyard2 version 2.1.14, which also ...
2
votes
1answer
736 views

Can Suricata be used as an effective IPS on a single server?

I've been looking for an effective intrusion prevention system (IPS) for an Ubuntu 14.04 server, something like what Symantec or F-Prot might offer for a Windows server. I've contacted major ...
0
votes
1answer
784 views

How to make rule trigger on DNS rdata/IP address? [duplicate]

I currently have the following DNS Query Alert rule set up in Suricata (for test purposes): alert dns any any -> any any (msg:”Test dns_query option”; dns_query; content:”google”; nocase; sid:1;) ...
1
vote
1answer
972 views

How to set Suricata to log only DNS queries that come from specific IP addresses?

I am new to working with IDS' such as Suricata/Snort. I am currently trying to using Suricata to log DNS requests and responses to malicious domains on my network. On my DNS server I made it so that ...
0
votes
0answers
507 views

Snort Installation Error

I am a newbie to Snort and doesnt have proper knowledge on installation and configuration of the same. I am following snort official document to install snort on an Ubuntu instance in AWS EC2. I have ...
1
vote
1answer
1k views

Replaying pcap file for Snort

I currently have the following, presumably standard, setup: I have a physical server with Snort running. Snort logs into its log files as it should. Those files are tracked by barnyard2 which writes ...
1
vote
0answers
4k views

Snort rule for detecting DNS packets of type NULL

I am trying to detect DNS requests of type NULL using Snort. I located the type field of the request packet using Wireshark: I found the following rule on McAfee: alert udp any any -> any 53 (msg:...
2
votes
1answer
2k views

What is the difference between fail2ban and snort?

I have a server that is exposed to the internet and I would like to provide some protection against DDOS attacks. Currently, I am considering using either fail2ban and/or snort. I know that they have ...
3
votes
2answers
1k views

is there any real Difference between snort and suricata?

Looking to move forward in deploying IDS/IPS on several FreeBSD firewalls and I was curious about the difference between snort and suricata. I know that Suricata is multi-threaded but in terms of rule ...
2
votes
0answers
155 views

Snort rules detection

I have a not detection snort rule in pcap. Some pcap files, this rule is detected, some other not. I tried lot of possible options, but no detection. Maybe if someone may help me, it should be good ;-)...
0
votes
1answer
32 views

Configure my first vServer [closed]

I recently rented my first vServer (Ubuntu, LAMP + Webmin preinstalled). I need it because of a Java app I wrote that should run as a game server on it. I'm familiar with Ubuntu as I'm using it as my ...
3
votes
2answers
6k views

pfSense and Disabling SURICATA UDPv4 invalid checksum

We have a pfSense router running with packet inspection. Our logs are filling up with these requests: SURICATA UDPv4 invalid checksum Research shows that we should do the following: Disable the ...
0
votes
1answer
155 views

Snort looking for invalid rules directory

I am in the middle of setting ups snort for the first time on Fedora 23. I have configured pulledpork for auto rules download. As you can see from the picture below, the test to see if pulledpork has ...
0
votes
1answer
922 views

suricata TLS rule not ignoring my “pass” entry

I'm using this rule to skip suricata tls processing on a known SSL cert: pass tls any any <> any any (msg:"known good mydomain cert"; tls.fingerprint:"40:.(trimmed for serverfault).:8b"; sid:...
1
vote
1answer
953 views

Why doesn't Snort match on DNS response?

This is likely a beginner's misunderstanding. System is: Ubuntu AMD64, 14.04.03 LTS; installed Snort with default configuration. I am writing a Snort rule that deals with DNS responses. In order to ...
-1
votes
1answer
437 views

barnyard2 for snort permission denied

I installed barnyard2 for snort, but when i run command below this error appear. [root@localhost snort]# barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort.log -w /etc/snort/bylog....
0
votes
1answer
552 views

Snort: users are not able to login when Wordpress Login Bruteforcing rule is on

I got this wordpress login bruteforcing rule from https://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-web_server.rules alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"...
1
vote
1answer
350 views

Is it possible to use syslog-ng to forward logs to SecurityOnion ELSA?

I have installed Snort IDS and syslog-ng on my VM, and I want to use syslog-ng to forward my logs to another vm which is SecurityOnion. So I want to know can syslog-ng forward logs to ELSA which is in ...
0
votes
1answer
1k views

PFSense / Snort / OpenVPN - one WAN interface

I have a pfsense box running both Snort and OpenVPN. The VPN worked great before installing Snort, now intermittently I cannot connect. Should I whitelist the port that the VPN uses on the WAN ...
0
votes
1answer
92 views

SNORT: Is a PCRE on SSNs intensive

I'm trying to write a Snort rule to look for SSNs. Due to the limitations of the appliance in place I can not use the pre-processor settings. How intense would it be to run a PCRE rule for SSNs? ...
0
votes
1answer
586 views

How to use Snort generate packet logs when in the NIDS mode?

I am using Snort act like a network IDS by implementing snort configuration file and snort rules, I also want to capture all the packets (traffic) going through the specific network interface. My ...
1
vote
2answers
2k views

How can I put snort in front of nginx server

I want to prevent attacks to my nginx server. How can I proxy the requests through snort to nginx server. NFQueue's are a solution.I am able to pass packets to snort using the following rules sudo ...
1
vote
2answers
2k views

Trouble Starting Snorby / Ruby dependency issue

I am trying to install Snorby on a CentOS 6.6 machine and keep getting an issue with ruby and my Gemfile. I believe I either have to edit my Gemfile or it has something to do with an installation ...
1
vote
1answer
2k views

Snort IDS on HAproxy with encrypted traffic

Using HAproxy, can I direct traffic to a backend server from all the other backend servers in a pool? From a networking standpoint, it would be comparable to mirroring all ports on a switch to one ...
4
votes
1answer
2k views

How do iptables work with NFQ in terms of traffic shaping in snort?

I'm trying to understand how iptables and NFQ work together with snort. The reason that I ask this is because from what I understand snort can be set to IPS via NFQ but if you have iptables there ...
2
votes
1answer
10k views

snort: drop icmp rule doesn't actually drop packets

I installed snort-2.9.7 from sources, and launch as IDS: % snort -devQ -A console -c /etc/snort/snort.conf -i eth0:eth1 Enabling inline operation Running in IDS mode ... The config file is very ...
1
vote
1answer
4k views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ==...