Questions tagged [snort]
Snort is a software package used for network intrusion detection.
124
questions
0
votes
0
answers
63
views
SMTP, snort: warning 124:3 attempted response buffer overflow
From time to time, I'm receiving a 124:3 warning "attempted response buffer overflow" from SNORT, while sending emails.
What could cause this warning? How can it be investigated? How can it ...
- 143
0
votes
2
answers
2k
views
Snort: How to block suspicious Traffic?
Snort comes by default (Debian) with a bunch of Rules. The are all configured as „Alert“. When I want to block suspicious traffic (IPS-Mode), do I need to change all Rules from Alert to Block or is ...
- 595
0
votes
1
answer
281
views
Snort DAQ: which NIC should run in promiscuous mode?
I want to use Snort 2.x as IPS. I have understood, that I need two NICs to capture the traffic (DAQ-Mode).
eth0 = my network card to the WAN
eth1 = my internal (virtual) NIC for Snort.
My current ...
- 595
0
votes
1
answer
107
views
What is uid in snort means
I was writing a snort rule for the specific exploit and then came across one solution that details as "uid=0(root)". Can someone explain what is that and why it is mentioned in order to ...
3
votes
1
answer
1k
views
Snort configuration: why is RULE_PATH undefined?
I am installing and configuring Snort 3 for the first time on CentOS 8 while following the Snort 3.0.3 on CentOS8 manual from Snort's official documentation (I can't link directly to it as it's ...
- 31
1
vote
1
answer
3k
views
snort3 Undefined variable in the string: HOME_NET
I have installed snort3 on my ubuntu server using this URL from the snort web site:
Snort 3.0.1 on Ubuntu 18 & 20
I have compiled it according to the instructions and edited /usr/local/etc/snort/...
- 143
0
votes
1
answer
314
views
how can i install Mysql alongside MariaDB without losing my data?
I am trying to install snort, barnyard2 and base that uses Mysql in the same machine where is MISP (platform sharing information) installed and that uses the MariaDB database.
I do the following steps ...
0
votes
1
answer
291
views
Can Snort write logs with the X-Forward-For or X-Real-IP headers instead of the source?
We're using HAProxy as a load balancer at layer 7 so that we can terminate SSL and inspect the traffic with Snort. The problem is that Snort sees the load balancer as the source instead of the ...
- 45
0
votes
1
answer
124
views
Using tc filter together with Snort
I need to add delay to packets after doing some modification using the SNORT inline module. However, I cannot seem to get the packets to match a filter using tc filter ... It always matches the ...
- 1
11
votes
1
answer
2k
views
Snort is receiving traffic, but doesn't appear to be applying rules
I have snort installed and running in inline mode via NFQUEUE on my local (as in I can walk in the next room and touch it) gateway. I have the following rule in my /etc/snort/rules/snort.rules:
alert ...
- 172
0
votes
1
answer
383
views
Ubuntu 18.04 snort protection
Recently I installed Snort on my Ubuntu server 18.04 And also wrote some rules in local.rules . it will perfectly detect my rules like ping , simple dos attacks etc.
I have 4 questions :
How can i ...
- 121
0
votes
0
answers
95
views
Use Snort 2.9 rules for Snort 2.8.6
Unfortunately Snort doesn't release rules update 2.8.6 since 2017.
All customer should upgrade to 2.9. But 2.9 is X64 and my OS is Fedora X86.
I need to update my Snort 2.8.6 signatures.
Is there any ...
1
vote
0
answers
195
views
Suricata: Error opening file threshold.config
I use Suricata 4.0.5 (an open source IDPS) on windows server 2012. It raises the below error when I run it, however, it runs.
Error opening file threshold.config
I searched for this error and find ...
- 326
2
votes
0
answers
2k
views
Suricata logs "A Network Trojan was detected". Is it false positive?
I use the Suricata as IDS on the local network that it doesn't the internet. It logged a few alerts from some clients that said A Network Trojan was detected.
All log's properties are in the following:...
- 326
1
vote
1
answer
3k
views
Suspicious DNS query leads to "Intrusion protection alert" on Sophos UTM
A customer Sophos-UTM reports Intrusion protection alert warnings INDICATOR-COMPROMISE suspicious .null dns query:
2019:01:15-11:54:13 utm-ba snort[31619]: id="2101" severity="warn" sys="SecureNet" ...
- 2,145
1
vote
0
answers
315
views
Snort for Windows - how to get payload info out to log file, for later analysis?
I am running Snort v2.9.12 for Windows.
I am getting (via -d option) payload information on console, but it is not going out to the Snort log file. I am only getting the header information.
I modify ...
- 11
1
vote
1
answer
1k
views
Snort not sniffing any traffic except it's own
I'm currently trying to set up Snort on my local machine. At the moment I have 3 VM's: 1 with snort on it and 2 used to ping eachother.
Whenever I ping from one of the devices to the Snort-machine, ...
1
vote
0
answers
617
views
Snort not dropping packets
as we want to protect our network from malicious traffic we think about setting up snort on our routers. For test reasons I built a system to replicate the network architecture consisting of my host ...
- 185
0
votes
0
answers
206
views
running snort and IGMP v2 flooding
I am not a network guru so please bear with me. I am running snort on a PLC (running rt-linux) along with an application that needs to communicate with another instance of the same application ...
- 101
1
vote
1
answer
3k
views
Suricata, Docker, and host networking: No non-docker traffic
I've created a docker container with Suricata and Evebox on it. On my host I start with:
ifconfig enp2s0:1 192.168.0.111 netmask 255.255.255.0 up
This sets up a new interface off my existing one. I ...
- 237
0
votes
0
answers
164
views
Making post alert script for snort
I`m trying to make a script that trigger an action if 5 snort rules ware broken in 24 hours interval.
I`m putting all my snort logs in alert.log
Can some one help me to make a script that motor this ...
0
votes
1
answer
394
views
Any way to save Suricata alert payload?
I've followed some directions for setting up Graylog and Snort (I used Suricata however) here but it would be nice to be able to see what the Alert payload was which generated the event.
An ...
- 3,714
-1
votes
1
answer
4k
views
snort rule for rdp dos attack
i am very new in snort rules so i can't find the below rule exactly . is this rule send alert when tcp packets come from external network and any port to home network and port 3389? just check port , ...
- 1
-1
votes
1
answer
656
views
specify the order of IDS , Firewall , WAF
i have an ubuntu system and i want to implement iptables as firewall, modsecurity as WAF and snort as IDS in this system and i have a server behind this system and i want to protect the server with ...
- 1
0
votes
1
answer
359
views
Snort and OSSEC Can't Run Simultaneously
I am trying to set up IDS on a system composed of AWS Ubuntu 16.04 instances. My HIDS is managed by OSSEC 2.8.1 and my NIDS is managed by Snort 2.9.9.0 (parsed by Barnyard2 version 2.1.14, which also ...
- 101
2
votes
1
answer
1k
views
Can Suricata be used as an effective IPS on a single server?
I've been looking for an effective intrusion prevention system (IPS) for an Ubuntu 14.04 server, something like what Symantec or F-Prot might offer for a Windows server. I've contacted major ...
0
votes
1
answer
1k
views
How to make rule trigger on DNS rdata/IP address? [duplicate]
I currently have the following DNS Query Alert rule set up in Suricata (for test purposes):
alert dns any any -> any any (msg:”Test dns_query option”; dns_query; content:”google”; nocase; sid:1;)
...
- 133
1
vote
1
answer
3k
views
How to set Suricata to log only DNS queries that come from specific IP addresses?
I am new to working with IDS' such as Suricata/Snort. I am currently trying to using Suricata to log DNS requests and responses to malicious domains on my network. On my DNS server I made it so that ...
- 133
0
votes
0
answers
1k
views
Snort Installation Error
I am a newbie to Snort and doesnt have proper knowledge on installation and configuration of the same. I am following snort official document to install snort on an Ubuntu instance in AWS EC2. I have ...
- 764
1
vote
1
answer
2k
views
Replaying pcap file for Snort
I currently have the following, presumably standard, setup:
I have a physical server with Snort running. Snort logs into its log files as it should. Those files are tracked by barnyard2 which writes ...
- 121
1
vote
0
answers
7k
views
Snort rule for detecting DNS packets of type NULL
I am trying to detect DNS requests of type NULL using Snort. I located the type field of the request packet using Wireshark:
I found the following rule on McAfee:
alert udp any any -> any 53 (msg:...
- 357
2
votes
1
answer
4k
views
What is the difference between fail2ban and snort?
I have a server that is exposed to the internet and I would like to provide some protection against DDOS attacks. Currently, I am considering using either fail2ban and/or snort. I know that they have ...
- 155
3
votes
2
answers
1k
views
is there any real Difference between snort and suricata?
Looking to move forward in deploying IDS/IPS on several FreeBSD firewalls and I was curious about the difference between snort and suricata. I know that Suricata is multi-threaded but in terms of rule ...
- 3,931
2
votes
0
answers
163
views
Snort rules detection
I have a not detection snort rule in pcap.
Some pcap files, this rule is detected, some other not. I tried lot of possible options, but no detection.
Maybe if someone may help me, it should be good ;-)...
- 33
0
votes
1
answer
37
views
Configure my first vServer [closed]
I recently rented my first vServer (Ubuntu, LAMP + Webmin preinstalled). I need it because of a Java app I wrote that should run as a game server on it. I'm familiar with Ubuntu as I'm using it as my ...
- 111
3
votes
2
answers
10k
views
pfSense and Disabling SURICATA UDPv4 invalid checksum
We have a pfSense router running with packet inspection. Our logs are filling up with these requests:
SURICATA UDPv4 invalid checksum
Research shows that we should do the following:
Disable the ...
- 3,931
0
votes
1
answer
576
views
Snort looking for invalid rules directory
I am in the middle of setting ups snort for the first time on Fedora 23. I have configured pulledpork for auto rules download. As you can see from the picture below, the test to see if pulledpork has ...
- 245
0
votes
1
answer
1k
views
suricata TLS rule not ignoring my "pass" entry
I'm using this rule to skip suricata tls processing on a known SSL cert:
pass tls any any <> any any (msg:"known good mydomain cert"; tls.fingerprint:"40:.(trimmed for serverfault).:8b"; sid:...
- 853
1
vote
1
answer
1k
views
Why doesn't Snort match on DNS response?
This is likely a beginner's misunderstanding.
System is: Ubuntu AMD64, 14.04.03 LTS; installed Snort with default configuration.
I am writing a Snort rule that deals with DNS responses. In order to ...
- 131
-1
votes
1
answer
703
views
barnyard2 for snort permission denied
I installed barnyard2 for snort, but when i run command below this error appear.
[root@localhost snort]# barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort.log -w /etc/snort/bylog....
- 1
0
votes
1
answer
698
views
Snort: users are not able to login when Wordpress Login Bruteforcing rule is on
I got this wordpress login bruteforcing rule from https://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-web_server.rules
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"...
- 177
1
vote
1
answer
411
views
Is it possible to use syslog-ng to forward logs to SecurityOnion ELSA?
I have installed Snort IDS and syslog-ng on my VM, and I want to use syslog-ng to forward my logs to another vm which is SecurityOnion. So I want to know can syslog-ng forward logs to ELSA which is in ...
- 142
0
votes
1
answer
1k
views
PFSense / Snort / OpenVPN - one WAN interface
I have a pfsense box running both Snort and OpenVPN. The VPN worked great before installing Snort, now intermittently I cannot connect.
Should I whitelist the port that the VPN uses on the WAN ...
- 319
0
votes
1
answer
102
views
SNORT: Is a PCRE on SSNs intensive
I'm trying to write a Snort rule to look for SSNs. Due to the limitations of the appliance in place I can not use the pre-processor settings. How intense would it be to run a PCRE rule for SSNs? ...
0
votes
1
answer
720
views
How to use Snort generate packet logs when in the NIDS mode?
I am using Snort act like a network IDS by implementing snort configuration file and snort rules, I also want to capture all the packets (traffic) going through the specific network interface.
My ...
- 142
1
vote
2
answers
3k
views
How can I put snort in front of nginx server
I want to prevent attacks to my nginx server. How can I proxy the requests through snort to nginx server.
NFQueue's are a solution.I am able to pass packets to snort using the following rules
sudo ...
- 119
1
vote
2
answers
2k
views
Trouble Starting Snorby / Ruby dependency issue
I am trying to install Snorby on a CentOS 6.6 machine and keep getting an issue with ruby and my Gemfile. I believe I either have to edit my Gemfile or it has something to do with an installation ...
- 11
1
vote
1
answer
3k
views
Snort IDS on HAproxy with encrypted traffic
Using HAproxy, can I direct traffic to a backend server from all the other backend servers in a pool? From a networking standpoint, it would be comparable to mirroring all ports on a switch to one ...
4
votes
1
answer
4k
views
How do iptables work with NFQ in terms of traffic shaping in snort?
I'm trying to understand how iptables and NFQ work together with snort.
The reason that I ask this is because from what I understand snort can be set to IPS via NFQ but if you have iptables there ...
- 41
2
votes
1
answer
14k
views
snort: drop icmp rule doesn't actually drop packets
I installed snort-2.9.7 from sources, and launch as IDS:
% snort -devQ -A console -c /etc/snort/snort.conf -i eth0:eth1
Enabling inline operation
Running in IDS mode
...
The config file is very ...
- 249