Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [snort]

Snort is a software package used for network intrusion detection.

0
votes
0answers
8 views

Snort inline mode with only two network interfaces

I am trying to configure snort in the inline mode in my machine running Linux. The machine has two physical interfaces but they share the same MAC address. Following is my /etc/network/interfaces file:...
0
votes
0answers
10 views

Use Snort 2.9 rules for Snort 2.8.6

Unfortunately Snort doesn't release rules update 2.8.6 since 2017. All customer should upgrade to 2.9. But 2.9 is X64 and my OS is Fedora X86. I need to update my Snort 2.8.6 signatures. Is there any ...
1
vote
0answers
23 views

Suricata: Error opening file threshold.config

I use Suricata 4.0.5 (an open source IDPS) on windows server 2012. It raises the below error when I run it, however, it runs. Error opening file threshold.config I searched for this error and find ...
2
votes
0answers
72 views

Suricata logs “A Network Trojan was detected”. Is it false positive?

I use the Suricata as IDS on the local network that it doesn't the internet. It logged a few alerts from some clients that said A Network Trojan was detected. All log's properties are in the following:...
0
votes
1answer
180 views

Suspicious DNS query leads to “Intrusion protection alert” on Sophos UTM

A customer Sophos-UTM reports Intrusion protection alert warnings INDICATOR-COMPROMISE suspicious .null dns query: 2019:01:15-11:54:13 utm-ba snort[31619]: id="2101" severity="warn" sys="SecureNet" ...
1
vote
0answers
11 views

Snort for Windows - how to get payload info out to log file, for later analysis?

I am running Snort v2.9.12 for Windows. I am getting (via -d option) payload information on console, but it is not going out to the Snort log file. I am only getting the header information. I modify ...
0
votes
0answers
21 views

Snort for Windows — Trying to get payload information out to file, via configuration file (snort.conf) output plugin

I am running Snort v2.9.12 for Windows. I am getting (via -d option) payload information on console, but it is not going out to the Snort log file. I am only getting the header information. I modify ...
1
vote
1answer
33 views

Snort not sniffing any traffic except it's own

I'm currently trying to set up Snort on my local machine. At the moment I have 3 VM's: 1 with snort on it and 2 used to ping eachother. Whenever I ping from one of the devices to the Snort-machine, ...
1
vote
0answers
29 views

Snort not dropping packets

as we want to protect our network from malicious traffic we think about setting up snort on our routers. For test reasons I built a system to replicate the network architecture consisting of my host ...
0
votes
0answers
53 views

running snort and IGMP v2 flooding

I am not a network guru so please bear with me. I am running snort on a PLC (running rt-linux) along with an application that needs to communicate with another instance of the same application ...
0
votes
0answers
90 views

OSSEC as NIDS or SNORT

I am not a sysadmin and my UNIX knowledge is a bit limited, but I am responsible of our platform servers. We have currently two debian servers (one for the web application and another for development ...
0
votes
0answers
70 views

Feasibility of containerizing NIDS components with Docker

I currently have numerous NIDS devices that consist of Snort, Bro, rolling packet capture and various log forwarders built directly onto a physical Linux OS (not virtualized at all). I feel like ...
1
vote
1answer
2k views

Suricata, Docker, and host networking: No non-docker traffic

I've created a docker container with Suricata and Evebox on it. On my host I start with: ifconfig enp2s0:1 192.168.0.111 netmask 255.255.255.0 up This sets up a new interface off my existing one. I ...
0
votes
0answers
31 views

Unable to see mirrored traffic from KVM host on Guest VM(Snort)

I once was running Snort on a spare laptop(1 NIC installed) in my home lab without any issues but then I thought to wipe the laptop and install KVM and make Snort a VM within KVM so that I can better ...
0
votes
0answers
31 views

Making post alert script for snort

I`m trying to make a script that trigger an action if 5 snort rules ware broken in 24 hours interval. I`m putting all my snort logs in alert.log Can some one help me to make a script that motor this ...
0
votes
1answer
106 views

Any way to save Suricata alert payload?

I've followed some directions for setting up Graylog and Snort (I used Suricata however) here but it would be nice to be able to see what the Alert payload was which generated the event. An ...
0
votes
0answers
331 views

Snort rules for detecting smb file transfer

does anybody have a SNORT rule to detect a simple file copy activity happening in Windows ? For example: If i copy a file from my Windows laptop to a remote Windows server via Windows Explorer or ...
0
votes
0answers
31 views

What is this snort rule looking for?

I have this Snort rule that was just deployed in our network and is now causing great deal of grief. Here is the content that it is searching for: content:"|31 01 02 00|"; fast_pattern; byte_extract:...
0
votes
0answers
136 views

Snort output auto generated names

I’m using snort’s configuration: output alert_csv: alert.csv timestamp,sig_id,dst But everytime that Snort finishes, I can see a file named alert.csv, instead of alert.csv.<timestamp> as other ...
0
votes
1answer
854 views

snort rule for rdp dos attack

i am very new in snort rules so i can't find the below rule exactly . is this rule send alert when tcp packets come from external network and any port to home network and port 3389? just check port , ...
-1
votes
1answer
277 views

specify the order of IDS , Firewall , WAF

i have an ubuntu system and i want to implement iptables as firewall, modsecurity as WAF and snort as IDS in this system and i have a server behind this system and i want to protect the server with ...
0
votes
1answer
174 views

Snort and OSSEC Can't Run Simultaneously

I am trying to set up IDS on a system composed of AWS Ubuntu 16.04 instances. My HIDS is managed by OSSEC 2.8.1 and my NIDS is managed by Snort 2.9.9.0 (parsed by Barnyard2 version 2.1.14, which also ...
2
votes
1answer
438 views

Can Suricata be used as an effective IPS on a single server?

I've been looking for an effective intrusion prevention system (IPS) for an Ubuntu 14.04 server, something like what Symantec or F-Prot might offer for a Windows server. I've contacted major ...
0
votes
1answer
364 views

How to make rule trigger on DNS rdata/IP address? [duplicate]

I currently have the following DNS Query Alert rule set up in Suricata (for test purposes): alert dns any any -> any any (msg:”Test dns_query option”; dns_query; content:”google”; nocase; sid:1;) ...
1
vote
1answer
483 views

How to set Suricata to log only DNS queries that come from specific IP addresses?

I am new to working with IDS' such as Suricata/Snort. I am currently trying to using Suricata to log DNS requests and responses to malicious domains on my network. On my DNS server I made it so that ...
0
votes
0answers
207 views

Snort Installation Error

I am a newbie to Snort and doesnt have proper knowledge on installation and configuration of the same. I am following snort official document to install snort on an Ubuntu instance in AWS EC2. I have ...
0
votes
1answer
627 views

Replaying pcap file for Snort

I currently have the following, presumably standard, setup: I have a physical server with Snort running. Snort logs into its log files as it should. Those files are tracked by barnyard2 which writes ...
1
vote
0answers
3k views

Snort rule for detecting DNS packets of type NULL

I am trying to detect DNS requests of type NULL using Snort. I located the type field of the request packet using Wireshark: I found the following rule on McAfee: alert udp any any -> any 53 (msg:...
2
votes
1answer
1k views

What is the difference between fail2ban and snort?

I have a server that is exposed to the internet and I would like to provide some protection against DDOS attacks. Currently, I am considering using either fail2ban and/or snort. I know that they have ...
3
votes
2answers
815 views

is there any real Difference between snort and suricata?

Looking to move forward in deploying IDS/IPS on several FreeBSD firewalls and I was curious about the difference between snort and suricata. I know that Suricata is multi-threaded but in terms of rule ...
3
votes
0answers
113 views

Snort rules detection

I have a not detection snort rule in pcap. Some pcap files, this rule is detected, some other not. I tried lot of possible options, but no detection. Maybe if someone may help me, it should be good ;-)...
0
votes
1answer
31 views

Configure my first vServer [closed]

I recently rented my first vServer (Ubuntu, LAMP + Webmin preinstalled). I need it because of a Java app I wrote that should run as a game server on it. I'm familiar with Ubuntu as I'm using it as my ...
2
votes
1answer
4k views

pfSense and Disabling SURICATA UDPv4 invalid checksum

We have a pfSense router running with packet inspection. Our logs are filling up with these requests: SURICATA UDPv4 invalid checksum Research shows that we should do the following: Disable the ...
0
votes
1answer
72 views

Snort looking for invalid rules directory

I am in the middle of setting ups snort for the first time on Fedora 23. I have configured pulledpork for auto rules download. As you can see from the picture below, the test to see if pulledpork has ...
0
votes
1answer
776 views

suricata TLS rule not ignoring my “pass” entry

I'm using this rule to skip suricata tls processing on a known SSL cert: pass tls any any <> any any (msg:"known good mydomain cert"; tls.fingerprint:"40:.(trimmed for serverfault).:8b"; sid:...
1
vote
1answer
718 views

Why doesn't Snort match on DNS response?

This is likely a beginner's misunderstanding. System is: Ubuntu AMD64, 14.04.03 LTS; installed Snort with default configuration. I am writing a Snort rule that deals with DNS responses. In order to ...
-1
votes
1answer
299 views

barnyard2 for snort permission denied

I installed barnyard2 for snort, but when i run command below this error appear. [root@localhost snort]# barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort.log -w /etc/snort/bylog....
0
votes
1answer
480 views

Snort: users are not able to login when Wordpress Login Bruteforcing rule is on

I got this wordpress login bruteforcing rule from https://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-web_server.rules alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"...
1
vote
1answer
236 views

Is it possible to use syslog-ng to forward logs to SecurityOnion ELSA?

I have installed Snort IDS and syslog-ng on my VM, and I want to use syslog-ng to forward my logs to another vm which is SecurityOnion. So I want to know can syslog-ng forward logs to ELSA which is in ...
0
votes
1answer
825 views

PFSense / Snort / OpenVPN - one WAN interface

I have a pfsense box running both Snort and OpenVPN. The VPN worked great before installing Snort, now intermittently I cannot connect. Should I whitelist the port that the VPN uses on the WAN ...
0
votes
1answer
88 views

SNORT: Is a PCRE on SSNs intensive

I'm trying to write a Snort rule to look for SSNs. Due to the limitations of the appliance in place I can not use the pre-processor settings. How intense would it be to run a PCRE rule for SSNs? ...
0
votes
1answer
396 views

How to use Snort generate packet logs when in the NIDS mode?

I am using Snort act like a network IDS by implementing snort configuration file and snort rules, I also want to capture all the packets (traffic) going through the specific network interface. My ...
1
vote
2answers
1k views

How can I put snort in front of nginx server

I want to prevent attacks to my nginx server. How can I proxy the requests through snort to nginx server. NFQueue's are a solution.I am able to pass packets to snort using the following rules sudo ...
1
vote
2answers
2k views

Trouble Starting Snorby / Ruby dependency issue

I am trying to install Snorby on a CentOS 6.6 machine and keep getting an issue with ruby and my Gemfile. I believe I either have to edit my Gemfile or it has something to do with an installation ...
1
vote
1answer
1k views

Snort IDS on HAproxy with encrypted traffic

Using HAproxy, can I direct traffic to a backend server from all the other backend servers in a pool? From a networking standpoint, it would be comparable to mirroring all ports on a switch to one ...
4
votes
1answer
2k views

How do iptables work with NFQ in terms of traffic shaping in snort?

I'm trying to understand how iptables and NFQ work together with snort. The reason that I ask this is because from what I understand snort can be set to IPS via NFQ but if you have iptables there ...
2
votes
1answer
8k views

snort: drop icmp rule doesn't actually drop packets

I installed snort-2.9.7 from sources, and launch as IDS: % snort -devQ -A console -c /etc/snort/snort.conf -i eth0:eth1 Enabling inline operation Running in IDS mode ... The config file is very ...
1
vote
1answer
4k views

snort complains on local.rules

I just installed snort-2.9.7.0 on Fedora 20, and am getting error when running: % snort -c /etc/snort/snort.conf --dump-dynamic-rules=/tmp Running in Rule Dump mode --== Initializing Snort ==...
0
votes
1answer
395 views

SNORT only alerting on inbound traffic

I am trying to raise an alert when someone is setting up a connection to PORT 25 (tcp), whatever source or destination. For this i came up with this simple rule: alert tcp any any -> any 25 (msg:"...
2
votes
3answers
14k views

Snort: Unable to open rules file

This is my first with snort. And I can't get it to run. I followed this tutorial exactly. And I have fedora 21. Here's the output from snort -c /etc/snort/snort.conf -v -i enp0s3: Running in IDS ...