Questions tagged [snort]
Snort is a open-source network intrusion detection/prevention system (NIDS/NIPS).
329
questions
0
votes
0
answers
9
views
Snort windows 10 Missing argument to RULE_PATH error
I am using sort 2.9.19. I am on windows 10 I am trying to test my snort.conf. I get the message
"ERROR: D:\Network Monitoring Tools\Snort2022\Snort\etc\snort.conf(117) Missing argument to ...
0
votes
0
answers
15
views
Snort inline IDS mode: not dropping packets
I am using mininet to set up an SDN, it basically consists of 1 switch and 3 hosts.
sudo mn --topo single,3
in snort.config
config policy_mode:inline
config daq: afpacket
config daq_mode: inline
in ...
0
votes
0
answers
15
views
Snort is not dropping the traffic or blocking the website
I used this snort rule to block a website but it is not blocking the website. I already made the mode inline but still it is not working. Can anyone help me in this regard?? It would be really helpful ...
0
votes
0
answers
43
views
Snort rule- flowbits- how to save 2 rules in the same session?
I'm trying to build a single session with flowbits to save the packets from both rules in the same session.
My rules are similar to the following example (please ignore the content, it is just for the ...
0
votes
0
answers
52
views
Snort - Source and Destination IP's missing from alert
We are running Snort 3.1.22. A log4j rule was recently triggered but the alert did not include any source or destination IP info. What are the circumstances where this info wouldn't be available in an ...
0
votes
0
answers
45
views
How to drop all Snort alarts that Intergration with Ryu controller?
I have standard simple_switch_snort.py script app from Ryu controller
how can I drop all alerts events from snort that will applied as flow in switch ?
Actually, I don't know the right way. Can you ...
0
votes
0
answers
53
views
Snort Error while snort is Initializing snort
I have installed snort, snort rules, wincap, and npcap. I replaced the files in snort rules (etc, preproc_rules, so_rules, rules) to the snort folder. This is all in my C drive.
When I try to run the ...
0
votes
1
answer
39
views
Convert strings with an unknown number of hex strings embedded in them to strings using regex
So I have a list of strings (content from Snort rules), and I am trying to convert the hex portions of them to UTF-8/ASCII, so I can send the content over netcat.
The method I have now works fine for ...
0
votes
0
answers
39
views
Snort Not Dropping ICMP Packets Even After Using Drop/Reject And Packet Loss Is Not 100%
snort command used->log file->ping command used to ping the machine
0
votes
0
answers
44
views
What is the Correct usage of Content Modifiers in Snort rule
I'm new in using Snort and I'm trying to understand Snort rules.
As I was reading Content Modifiers section in snort's manual, it is mentioned that content modifiers should be used after a content in ...
0
votes
0
answers
59
views
How to view snort.log files
enter image description here
My snort.log file is completely empty and my snort.log.xxxxx files contain the characters @#...
I already know how to read the snort.log.xxx file but my snort.log file is ...
0
votes
0
answers
34
views
ryu.exception.OFPUnknownVersion: unknown version 50 for snort alarms
i am working on mininet, snort, and remote ryu controller.
i do the integration of snort with ryu (exactly like this https://ryu.readthedocs.io/en/latest/snort_integrate.html)
and snort works well and ...
0
votes
0
answers
103
views
Installing Snort fails at Linking CXX executable snort
I was attempting to make a snort build using snort3-3.1.6.0 and it terminates at:
[ 84%] Linking CXX executable snort
collect2: fatal error: ld terminated with signal 9 [Killed]
compilation terminated....
0
votes
0
answers
151
views
How to configure snort 3 to detect namp's port scanning?
How to configure snort 3 to detect nmap's port scanning? For instance I want to know that an external machine A is looking with nmap for open ports on my machine B. Such a port scan can include all ...
0
votes
0
answers
246
views
ERROR: Snort configuration validation failed on windows 10
I am trying to install snort into my computer. Every was fine until I validated my snort.conf file. It seems like my computer won't take my rules dir but it will take the dir of the snort.conf and add ...
0
votes
0
answers
180
views
How to run Snort in inline-test mode
I need to run Snort in inline-test mode but I'm not sure it is set up correctly.
I put:
config policy_mode:inline_test
in the snort.conf file
[![enter image description here][1]][1]
I just added it ...
0
votes
0
answers
74
views
Snort missing alerts on packets intermittently
I have set up a snort server to detect all SSH connections between internal machines on my network.
alert tcp $HOME_NET any -> $HOME_NET any ( msg:"SSH: Internal <-> Internal Connection ...
0
votes
0
answers
51
views
Example of a Dynamic Snort Rule
I'm finishing a project for bootcamp, and I have no idea how to create a dynamic rule, this is like tryinig to learn Python, another subject which the bootcamp only lightly touched on.
Given that you ...
0
votes
0
answers
219
views
Generate alerts from pcap file with Snort
I'm learning to use snort by myself and I can't figure out if I'm generating alerts from a file well.
The rules i have in local.rules are:
alert icmp any any -> any any (msg:"Testing ICMP"...
0
votes
0
answers
21
views
Using Snort 2.9.18 in for Distributed Intrusion Detection system
I have one LAN consisting 6 machines (Ubuntu 20.04) each machine has Snort with specific rules that different than other machines.
How to run all Snorts at the same time.
For example if I sent traffic ...
0
votes
0
answers
45
views
Snort rule isn't matching traffic
I'm running Snort on an Ubuntu 20.04 LTS, and wrote the following rule (in local.rules) in order to monitor failed FTP logins:
alert tcp any any -> any any (msg:"FTP Connection Attempt"; ...
0
votes
0
answers
53
views
Why the snort rules cannot be matched when sending files by email
Recently, I was sending malware files through email to test snort rules, and downloaded theZoo from github (https://github.com/ytisf/theZoo). I built a mail server by myself and uploaded and ...
1
vote
0
answers
108
views
How to manually generate a TCP packet with python
I need to generate TCP packet with ACK flag enabled and value 0.
This is to test Snort rules:
alert icmp any any -> any any (msg: "TCP PING DETECT"; flag: A; value: 0)
I haven't found any ...
0
votes
0
answers
62
views
Snort Rule to prevent malicious file from downloading
I am looking for a snort rule that prevents malicious file from downloading. If there isn't exist any rule then how to create custom rule. Like give the signature of file to prevent from future ...
0
votes
0
answers
14
views
SNORT returning a Source IP different from IP triggering the alert
I recently started having an issue with SNORT after many changes while working on a project.
I am running this command:
sudo snort -c covert-channels/defender/snort/test_snort.conf -i enp0s8:enp0s3 -Q ...
0
votes
0
answers
194
views
SNORT in IPS Mode DROP alert but not dropping
I am running SNORT in IPS mode using:
sudo snort -c covert-channels/defender/snort/test_snort.conf -i enp0s8:enp0s3 -Q -A console -q
With test_snort.conf is a direct copy of snort.conf during ...
0
votes
0
answers
231
views
How to create a custom Preprocessor with Snort?
I'm using Snort 2.9 and I'm trying to create my custom HelloWorld preprocessor.
I'm following this example as a guideline.
When compiling Snort the preprocessor is being seen/compiled.
The error ...
0
votes
1
answer
166
views
Snort configuration on windows
Let me preface this by saying I'm an utter noob at setting up an IDS system like SNORT, but certain situations are calling for it. Anyway, I just went through the snort.config file and configured ...
0
votes
0
answers
15
views
how to delete acid_event in Snort?
I inherited a snort server from the previous admin and now the table acid event is full and I have no idea how to delete that. I know a little of snort but not to that extend; please any help will be ...
0
votes
0
answers
74
views
How to make a Docker architecture with Traefik and Snort3
I'm trying to find a way to do the following architecture with Docker, Traefik and Snort3.
I need to understand what it is possible to do with this two systems to make that secure.
In the left image ...
0
votes
0
answers
129
views
snort rule to detect SSl certificate
I'm trying to learn snort an run to the following rule :
drop tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected(MalwareC&C)"; tls.fingerprint:&...
-1
votes
1
answer
153
views
How to alert if someone goes on a website other than the IP address listed?
I have a snort rule
alert tcp any -> !142.250.200.14 any (msg:"Bad Website"; sid:1000002; rev:1;)
The problem is it logs all websites, including the one listed as 142.250.200.14 as 'bad ...
0
votes
2
answers
58
views
Trying to separate the date time in snort log (.csv)
I have set Snort up to output alerts into a excel.csv directly with my required information.
I am using Python to input the values in my excel.csv into a database. < This works, no issues here
...
0
votes
1
answer
121
views
fail2ban-regex doesn't match snort logfile in alert_json format
I try to match a fail2ban-regex with a snort3 logfile in alert_json format.
example alert_json output in log-file:
{ "timestamp" : "21/03/22-12:23:56.370262", "seconds" : ...
1
vote
1
answer
185
views
Snort could not find rule type activate
As snort docs say, I can use rule types Activate/Dynamic:
Activate/Dynamic Rules
Activate/dynamic rule pairs give Snort a powerful capability.
You can now have one rule activate another when it's ...
0
votes
1
answer
63
views
Snort configuration dead end
I'm in a dead end at the configuration of snort.
In theory a simple problem.
I created a test rule to check if snort runs properly.
Location:\etc\snort\rules\local.rules
Content:
alert icmp any any -&...
1
vote
4
answers
1k
views
Snort 3.0 Error: Could not find requested DAQ moduel: pcap
I am trying to install Snort 3.0 on an Ubuntu 20.04 desktop. I'm using the manual as a guide for this install. Everything went well and it seems the install went fine, however, at page 6, to test ...
1
vote
4
answers
2k
views
Snort pcap_inject not located
I try to experiment the Intrusion Detection System(IDS) using Snort,I installed Snort and WinPcap packages after that I copy the Rules file and paste it to "C:\Snort\rules" next I try to ...
0
votes
1
answer
42
views
What is the less symbol sign in snort content
For example in snort, there might be content like
content:"|C0 0C 00 0C 00 10 00 00 00 00| < |OO OF|"
May I know what is the meaning of "<" between two hex values?
Thanks
0
votes
1
answer
144
views
How to use tcpdump file to test syn flood attack?
I have a tcpdump file that will simulate a SYN flood attack. I have rules set up in SNORT that I would like to test on this tcpdump file. How would I go about running this on the command line? Or ...
0
votes
0
answers
50
views
How to configure network on Ubuntu 16 VM running on Openstack host?
I am a junior in college, trying to do a simple project involving Devstack. Right now, I am trying to install Snort on a VM running through my Devstack host. It is going very slow, but I think I may ...
0
votes
1
answer
147
views
I want to send snort3 alert on socket but when I run command " sudo snort -i ens33 -A alert_unixsock -l /tmp" it gives error
I run snort 3 via command
sudo snort -c snort.conf -i ens33 -A alert_unixsock -l /tmp
where as snort gives error: "/tmp/snort_alert file doesn't exist or isn't writable".
Can any one share ...
0
votes
1
answer
488
views
daq with error make: *** [Makefile:344: Makefile.in] Error 1
I learn about Snort and when I install it, I must install daq. When I implement./configure && make && sudo make install I see this warning:
cd . && /bin/bash /home/snort/...
0
votes
0
answers
335
views
Snort Rule to Detect Base64 Encoding
I am trying to incorporate the following Regex to a snort rule to detect base64 in outbound ICMP traffic: ^-A-Za-z0-9+/=]|=[^=]|={3,}$
I did not write this expression myself, however I tested it and ...
-2
votes
1
answer
101
views
Can't use array as an reference SnortSnarf HTMLMemStorage [closed]
I'm trying to install SnortSnarf and I'm getting the following error on Ubuntu, next to the terminal is the HTMLMemStorage.pm file.
I've tried playing around with Line 290 but none of it worked and ...
1
vote
1
answer
96
views
Snort detect file access of exisiting files
I've allready got a working rule for accessing files of a specific format (pcre). The problem is, that the rule also fires for files, that match the pattern, but don't exist. Now the rule should only ...
0
votes
1
answer
295
views
Snort Rules configuration problems
Hi I just installed Snort on debian and configure it as random implementation as i don't know why is it not running afterall, could you reviev my configuration of Snort.
I run my snort by command (on ...
1
vote
1
answer
237
views
How to monitor file downloads in python?
I have a two virtual machines, one with 2 network adaptaters (windows server), one connected to internet and the other to a LAN. The second virtual machine (windows client is connected to the LAN and ...
1
vote
0
answers
257
views
How do I get Snort to log the packets that match a given rule?
I'd like my Snort IDS to log all traffic from any IP address on any port that comes to my machine through any well-known port. I've set up my snort.conf file appropriately and saved the following rule ...