The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
68 views

Scanning files over http by suricata or snort

I want to use IDS or IPS system like Snort or Suricata for the purpose of scanning files which are send by HTTP (or different way). Let's assume that files are not encrypted by the way. Any rule or ...
0
votes
1answer
407 views

Help With PulledPork Please

I have been working to get snort, barnyard2 and pulledpork installed on my Ubuntu machine, and I have the 1st two installed not problem. With pulledpork I cant seem to get past this error message: ...
1
vote
0answers
31 views

How can I simply access a packet's payload and modify it?

I am attempting to access a packet's payload and modify it with a word (let's say Bob). I have a simple tunnel VPN program written in C that displays packets in plain-text. When I connect to a host, ...
2
votes
3answers
1k views

Make: recipe for target 'pcap-bt-monitor-linux.o' failed

I'm following this guide to install snort on my Debian Linux. In step 2 while executing the command 'Make' to build libpcap I'm getting the error 'recipe for target 'pcap-bt-monitor-linux.o' failed' ...
0
votes
1answer
586 views

libdnet is installed but can't be found by snort

I'm running Fedora 22 and just installed snort: sudo dnf install snort When trying to run it I get: $ snort snort: error while loading shared libraries: libdnet.1: cannot open shared object file: ...
1
vote
1answer
1k views

Problem when downloading snort rules [closed]

I have a problem when downloading new rules via pulledpork. After using... $ pulledpork.pl -c /etc/snort/pulledpork.conf -T -vv I get an error: Fetching md5sum for: snortrules-snapshot-2960.tar.gz....
1
vote
0answers
350 views

Snort PCAP file analysing doesn't write to alert file

I'm using snort in my ubuntu 14.04 virtual machine. This is how I installed snort. sudo apt-get update sudo apt-get install snort I haven't change /etc/snort/snort.conf or rules file. They remain ...
3
votes
3answers
3k views

What's the most effective way to detect nmap scans?

As the title says, I am interested in detecting any nmap scans directed on a (my) GNU/Linux host. I would like to use snort in combination with barnyard2 and snorby for this, or if possible to perform ...
2
votes
1answer
2k views

Got the “ERROR: Cannot decode data link type 239” message when turn on sniffer mode

I would like install snort 2.9.6 into Centos 7 the installation is ok and the result of the self-testing mode is correct but when I run this command to change Snort into sniffer or nids mode. I got ...
0
votes
1answer
675 views

How to start the Snort service with logging enabled?

I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created ...
0
votes
1answer
2k views

Cannot install Snort 2.9.6.1 due to “Not a compatible architecture”

I have Centos 6.5 installed on a Dell Inspirion Intel chip. When I entered uname -a I got Linux family.room 2.6.32-431.el6.i686 #1 SMP Fri Nov 22 00:26:36 UTC 2013 i686 i686 i386 GNU/Linux I ...
1
vote
1answer
447 views

How to install 64 Bit snort on 64 Bit openSUSE 13.1?

My question is simple: I would like to install 64 Bit snort on my 64 Bit openSUSE 13.1. There is an unstable package available here:http://software.opensuse.org/package/snort I got everything but ...
2
votes
1answer
11k views

Resolve dependencies installing rpm packages

I am using RHEL6 Hi i have created the yum repository, i downloaded the snort rpm package from their website when i tried to install the rpm its thorws error e.g. snort-2.9.5.3-1.f18.i386.rpm 1:...
1
vote
1answer
869 views

Read snort.u2 files

I am just getting started with learning and testing snort. I have some snort data in snort.u2.timestamp files. What is the best way to view / read these files? I have found some info via Google ...
1
vote
1answer
224 views

Blocking gzip HTTP content with Iptables or Snort?

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
1
vote
0answers
750 views

Can't launch Snort on CentOS 6.3 [closed]

I have a problem installing Snort on CentOS 6.3 in a virtual environment. When I run snort - ./snort status: Running in packet dump mode --== Initializing Snort ==-- Initializing Output ...