Questions tagged [snort]
Snort is a software package used for network intrusion detection.
129
questions
0
votes
0
answers
53
views
Install snort error with make
make[2]: *** [scr/js_norm/CMakeFiles/js_norm.dir/build.make:106:
src/js_norm/CMakeFiles/js_norm.dir/js_tokenizer.cc.o] Error 1
When I run the command make -j $(noproc) I get an error like on the ...
- 5
0
votes
1
answer
2k
views
Snort Version 3.1.78.0. I am unable to locate the snort.conf file on my Linux system
I have checked the /etc/snort/ and /usr/local/etc/snort/ directories but could not find the snort.conf file. I also attempted to use the
sudo find / -name snort.conf
sudo find / -type f -name snort....
0
votes
0
answers
45
views
How can I detect an exe installed from an HTTP server using SNORT
alert tcp any any -> any 80 (msg:"HTTP File Download Detected"; flow:to_server,established; content:"GET "; http_method; content:".exe"; http_uri; sid:1000001;)
On ...
0
votes
0
answers
27
views
Is the "logto" option in snort rule still work?
I can't make it work.
I use this one line file as my.rules
alert tcp any any <> any any (msg:"test";sid:12345;logto:"log.txt";)
And run snort like
sudo snort -c ~/tmp/my....
- 11
1
vote
0
answers
88
views
Why does snort can not alert this pcap?
the rule is
alert tcp any any <> any any (sid:11111;content:"GET";)
a file named http.pcap,in which has content
GET /s?wd=%E7%99%BE%E5%BA%A6 HTTP/1.0
a config file named 1.conf
...
- 11
0
votes
0
answers
464
views
SMTP, snort: warning 124:3 attempted response buffer overflow
From time to time, I'm receiving a 124:3 warning "attempted response buffer overflow" from SNORT, while sending emails.
What could cause this warning? How can it be investigated? How can it ...
- 143
0
votes
2
answers
3k
views
Snort: How to block suspicious Traffic?
Snort comes by default (Debian) with a bunch of Rules. The are all configured as „Alert“. When I want to block suspicious traffic (IPS-Mode), do I need to change all Rules from Alert to Block or is ...
- 715
0
votes
1
answer
421
views
Snort DAQ: which NIC should run in promiscuous mode?
I want to use Snort 2.x as IPS. I have understood, that I need two NICs to capture the traffic (DAQ-Mode).
eth0 = my network card to the WAN
eth1 = my internal (virtual) NIC for Snort.
My current ...
- 715
0
votes
1
answer
124
views
What is uid in snort means
I was writing a snort rule for the specific exploit and then came across one solution that details as "uid=0(root)". Can someone explain what is that and why it is mentioned in order to ...
3
votes
1
answer
2k
views
Snort configuration: why is RULE_PATH undefined?
I am installing and configuring Snort 3 for the first time on CentOS 8 while following the Snort 3.0.3 on CentOS8 manual from Snort's official documentation (I can't link directly to it as it's ...
- 31
1
vote
1
answer
4k
views
snort3 Undefined variable in the string: HOME_NET
I have installed snort3 on my ubuntu server using this URL from the snort web site:
Snort 3.0.1 on Ubuntu 18 & 20
I have compiled it according to the instructions and edited /usr/local/etc/snort/...
- 152
0
votes
1
answer
432
views
how can i install Mysql alongside MariaDB without losing my data?
I am trying to install snort, barnyard2 and base that uses Mysql in the same machine where is MISP (platform sharing information) installed and that uses the MariaDB database.
I do the following steps ...
0
votes
1
answer
427
views
Can Snort write logs with the X-Forward-For or X-Real-IP headers instead of the source?
We're using HAProxy as a load balancer at layer 7 so that we can terminate SSL and inspect the traffic with Snort. The problem is that Snort sees the load balancer as the source instead of the ...
- 45
0
votes
1
answer
147
views
Using tc filter together with Snort
I need to add delay to packets after doing some modification using the SNORT inline module. However, I cannot seem to get the packets to match a filter using tc filter ... It always matches the ...
- 1
11
votes
1
answer
3k
views
Snort is receiving traffic, but doesn't appear to be applying rules
I have snort installed and running in inline mode via NFQUEUE on my local (as in I can walk in the next room and touch it) gateway. I have the following rule in my /etc/snort/rules/snort.rules:
alert ...
- 172
0
votes
1
answer
445
views
Ubuntu 18.04 snort protection
Recently I installed Snort on my Ubuntu server 18.04 And also wrote some rules in local.rules . it will perfectly detect my rules like ping , simple dos attacks etc.
I have 4 questions :
How can i ...
- 121
0
votes
0
answers
102
views
Use Snort 2.9 rules for Snort 2.8.6
Unfortunately Snort doesn't release rules update 2.8.6 since 2017.
All customer should upgrade to 2.9. But 2.9 is X64 and my OS is Fedora X86.
I need to update my Snort 2.8.6 signatures.
Is there any ...
1
vote
0
answers
240
views
Suricata: Error opening file threshold.config
I use Suricata 4.0.5 (an open source IDPS) on windows server 2012. It raises the below error when I run it, however, it runs.
Error opening file threshold.config
I searched for this error and find ...
- 338
2
votes
0
answers
2k
views
Suricata logs "A Network Trojan was detected". Is it false positive?
I use the Suricata as IDS on the local network that it doesn't the internet. It logged a few alerts from some clients that said A Network Trojan was detected.
All log's properties are in the following:...
- 338
1
vote
1
answer
3k
views
Suspicious DNS query leads to "Intrusion protection alert" on Sophos UTM
A customer Sophos-UTM reports Intrusion protection alert warnings INDICATOR-COMPROMISE suspicious .null dns query:
2019:01:15-11:54:13 utm-ba snort[31619]: id="2101" severity="warn" sys="SecureNet" ...
- 2,195
1
vote
0
answers
367
views
Snort for Windows - how to get payload info out to log file, for later analysis?
I am running Snort v2.9.12 for Windows.
I am getting (via -d option) payload information on console, but it is not going out to the Snort log file. I am only getting the header information.
I modify ...
- 11
1
vote
1
answer
2k
views
Snort not sniffing any traffic except it's own
I'm currently trying to set up Snort on my local machine. At the moment I have 3 VM's: 1 with snort on it and 2 used to ping eachother.
Whenever I ping from one of the devices to the Snort-machine, ...
1
vote
0
answers
770
views
Snort not dropping packets
as we want to protect our network from malicious traffic we think about setting up snort on our routers. For test reasons I built a system to replicate the network architecture consisting of my host ...
- 185
0
votes
0
answers
250
views
running snort and IGMP v2 flooding
I am not a network guru so please bear with me. I am running snort on a PLC (running rt-linux) along with an application that needs to communicate with another instance of the same application ...
- 101
1
vote
1
answer
3k
views
Suricata, Docker, and host networking: No non-docker traffic
I've created a docker container with Suricata and Evebox on it. On my host I start with:
ifconfig enp2s0:1 192.168.0.111 netmask 255.255.255.0 up
This sets up a new interface off my existing one. I ...
- 237
0
votes
0
answers
183
views
Making post alert script for snort
I`m trying to make a script that trigger an action if 5 snort rules ware broken in 24 hours interval.
I`m putting all my snort logs in alert.log
Can some one help me to make a script that motor this ...
0
votes
1
answer
442
views
Any way to save Suricata alert payload?
I've followed some directions for setting up Graylog and Snort (I used Suricata however) here but it would be nice to be able to see what the Alert payload was which generated the event.
An ...
- 3,824
-1
votes
1
answer
4k
views
snort rule for rdp dos attack
i am very new in snort rules so i can't find the below rule exactly . is this rule send alert when tcp packets come from external network and any port to home network and port 3389? just check port , ...
- 1
-1
votes
1
answer
736
views
specify the order of IDS , Firewall , WAF
i have an ubuntu system and i want to implement iptables as firewall, modsecurity as WAF and snort as IDS in this system and i have a server behind this system and i want to protect the server with ...
- 1
0
votes
1
answer
388
views
Snort and OSSEC Can't Run Simultaneously
I am trying to set up IDS on a system composed of AWS Ubuntu 16.04 instances. My HIDS is managed by OSSEC 2.8.1 and my NIDS is managed by Snort 2.9.9.0 (parsed by Barnyard2 version 2.1.14, which also ...
- 101
2
votes
1
answer
1k
views
Can Suricata be used as an effective IPS on a single server?
I've been looking for an effective intrusion prevention system (IPS) for an Ubuntu 14.04 server, something like what Symantec or F-Prot might offer for a Windows server. I've contacted major ...
0
votes
1
answer
2k
views
How to make rule trigger on DNS rdata/IP address? [duplicate]
I currently have the following DNS Query Alert rule set up in Suricata (for test purposes):
alert dns any any -> any any (msg:”Test dns_query option”; dns_query; content:”google”; nocase; sid:1;)
...
- 133
1
vote
1
answer
4k
views
How to set Suricata to log only DNS queries that come from specific IP addresses?
I am new to working with IDS' such as Suricata/Snort. I am currently trying to using Suricata to log DNS requests and responses to malicious domains on my network. On my DNS server I made it so that ...
- 133
0
votes
0
answers
1k
views
Snort Installation Error
I am a newbie to Snort and doesnt have proper knowledge on installation and configuration of the same. I am following snort official document to install snort on an Ubuntu instance in AWS EC2. I have ...
- 764
1
vote
1
answer
2k
views
Replaying pcap file for Snort
I currently have the following, presumably standard, setup:
I have a physical server with Snort running. Snort logs into its log files as it should. Those files are tracked by barnyard2 which writes ...
- 121
1
vote
0
answers
7k
views
Snort rule for detecting DNS packets of type NULL
I am trying to detect DNS requests of type NULL using Snort. I located the type field of the request packet using Wireshark:
I found the following rule on McAfee:
alert udp any any -> any 53 (msg:...
- 367
2
votes
1
answer
4k
views
What is the difference between fail2ban and snort?
I have a server that is exposed to the internet and I would like to provide some protection against DDOS attacks. Currently, I am considering using either fail2ban and/or snort. I know that they have ...
- 155
3
votes
2
answers
2k
views
is there any real Difference between snort and suricata?
Looking to move forward in deploying IDS/IPS on several FreeBSD firewalls and I was curious about the difference between snort and suricata. I know that Suricata is multi-threaded but in terms of rule ...
- 3,941
2
votes
0
answers
171
views
Snort rules detection
I have a not detection snort rule in pcap.
Some pcap files, this rule is detected, some other not. I tried lot of possible options, but no detection.
Maybe if someone may help me, it should be good ;-)...
- 33
0
votes
1
answer
40
views
Configure my first vServer [closed]
I recently rented my first vServer (Ubuntu, LAMP + Webmin preinstalled). I need it because of a Java app I wrote that should run as a game server on it. I'm familiar with Ubuntu as I'm using it as my ...
- 121
3
votes
2
answers
11k
views
pfSense and Disabling SURICATA UDPv4 invalid checksum
We have a pfSense router running with packet inspection. Our logs are filling up with these requests:
SURICATA UDPv4 invalid checksum
Research shows that we should do the following:
Disable the ...
- 3,941
0
votes
1
answer
690
views
Snort looking for invalid rules directory
I am in the middle of setting ups snort for the first time on Fedora 23. I have configured pulledpork for auto rules download. As you can see from the picture below, the test to see if pulledpork has ...
- 245
0
votes
1
answer
2k
views
suricata TLS rule not ignoring my "pass" entry
I'm using this rule to skip suricata tls processing on a known SSL cert:
pass tls any any <> any any (msg:"known good mydomain cert"; tls.fingerprint:"40:.(trimmed for serverfault).:8b"; sid:...
- 863
1
vote
1
answer
1k
views
Why doesn't Snort match on DNS response?
This is likely a beginner's misunderstanding.
System is: Ubuntu AMD64, 14.04.03 LTS; installed Snort with default configuration.
I am writing a Snort rule that deals with DNS responses. In order to ...
- 131
-1
votes
1
answer
737
views
barnyard2 for snort permission denied
I installed barnyard2 for snort, but when i run command below this error appear.
[root@localhost snort]# barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort/ -f snort.log -w /etc/snort/bylog....
- 1
0
votes
1
answer
722
views
Snort: users are not able to login when Wordpress Login Bruteforcing rule is on
I got this wordpress login bruteforcing rule from https://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-web_server.rules
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"...
- 177
1
vote
1
answer
422
views
Is it possible to use syslog-ng to forward logs to SecurityOnion ELSA?
I have installed Snort IDS and syslog-ng on my VM, and I want to use syslog-ng to forward my logs to another vm which is SecurityOnion. So I want to know can syslog-ng forward logs to ELSA which is in ...
- 142
0
votes
1
answer
2k
views
PFSense / Snort / OpenVPN - one WAN interface
I have a pfsense box running both Snort and OpenVPN. The VPN worked great before installing Snort, now intermittently I cannot connect.
Should I whitelist the port that the VPN uses on the WAN ...
- 319
0
votes
1
answer
117
views
SNORT: Is a PCRE on SSNs intensive
I'm trying to write a Snort rule to look for SSNs. Due to the limitations of the appliance in place I can not use the pre-processor settings. How intense would it be to run a PCRE rule for SSNs? ...
0
votes
1
answer
847
views
How to use Snort generate packet logs when in the NIDS mode?
I am using Snort act like a network IDS by implementing snort configuration file and snort rules, I also want to capture all the packets (traffic) going through the specific network interface.
My ...
- 142