Questions tagged [snort]

Snort is a free open source network intrusion detection system (IDS) and intrusion prevention system (IPS).

Filter by
Sorted by
Tagged with
1 vote
0 answers
99 views

How can I make a local only bridged interface using the IP utility for SNORT?

I am trying to use the Snort IPS. In order to use it as an inline prevention system I need to make two interfaces and snort will bridge the two to apply its rules as a packet passes through the bridge....
l3m0n's user avatar
  • 11
1 vote
1 answer
431 views

How do I generate a Snort pcap file?

I am new to using snort and still learning in university. I am wondering after I find an intrusion how can I log it and save it as a pcap file? What would the syntax look like to do this? So I can ...
Albion69's user avatar
0 votes
1 answer
94 views

snort doesn't alert other host port scanning

I have this configuration:vmware debian11 running snort, vmware kali Linux running nmap that scans ports of Debian 11(real). snort doesn't alert port scanning in this case. instead if I scans ports of ...
CaneRandagio's user avatar
1 vote
0 answers
683 views

Blocking FTP Brute Force Attack with Snort

I am trying to become familiar with Snort, and for this reason, I have set three VMs. A Kali, a windows machine with XAMPP and Ubuntu where I installed Snort. I believe I have Snort running in ...
george's user avatar
  • 11
0 votes
2 answers
3k views

Unable to locate package snort_Kali LInux in VMware Workstation Pro (ver 15.5.6)

Checked answers to the similar question. Still not working for me. Current entries in /etc/apt/sources.list: 1. deb http://http.kali.org/kali kali-rolling main non-free contrib 2. deb http://http.kali....
kstatinet's user avatar
1 vote
1 answer
22k views

Unable to locate package snort

I am having problem with installing snort on Kali. I used the command: sudo apt-get install snort -y but it replies only that unable to locate the package error. I did upgrade, update, edit sources....
sayed hussain's user avatar
0 votes
1 answer
108 views

Does intrusion detection system(IDS) make sense on a firewalled web-server?

I'm running Apache on a server with stateful firewall where new IPv4/IPv6 ingress connections are allowed only to TCP ports 80 and 443. SSH is allowed from few trusted hosts and only certain ICMP/...
Martin's user avatar
  • 7,496
1 vote
0 answers
2k views

How to monitor system with `snort` and send emails about `alerts`

PROBLEM: I have been configuring snort on my systems and would like to get emails from the systems if there are any alerts. What I have tried is swatch but I can't find much documentation on it, can ...
somethingSomething's user avatar
0 votes
1 answer
66 views

Log file extract data and append back same line

I have a snort.rule file, I need to extract cve numbers followed by reference key from the line and append them back in msg field of the same line inside flower brackets, below is the old log. ...
Jacob_'s user avatar
  • 1
1 vote
0 answers
45 views

Match SNORT IP alerts to specific URLs

I have SNORT running on an Ubuntu 18.04 server. I have alerts firing off but the alert logs come through as IP addresses. I have a list of websites the system has visited throughout the day. Is ...
Softey's user avatar
  • 113
1 vote
1 answer
2k views

barnyard missing SID msg map file from snort

I installed snort (currently ver. 2.9.7.0-5) then compiled Barnyard2 Version 2.1.14 (Build 337). At first try with: sudo ./barnyard2 -c ../etc/barnyard2.conf -o /var/log/snort/snort.alert I get ...
Adrian's user avatar
  • 679
1 vote
0 answers
74 views

Limiting concurrent connections from a particular host to a particular host on a particular port?

I am trying to find a way to stop port scans or DoS type activities from within the network to external resources so I can reduce the number of abuse complaints. While I know there are numerous tools ...
Chris Wong's user avatar
1 vote
1 answer
2k views

How to generate network traffic and save it to pcap files?

I want to test snort, so I want to have some test network traffic. Since snort can read pcap files, I want to generate some traffics which can be customized and save it to pcap files. Here are my ...
Yanghao Xie's user avatar
0 votes
1 answer
537 views

Use of decoder.rules & preproc.rules in Snort

I am working with snort. While configuring I have come across rule files such as decoder.rules and preproc.rules. Can any one please tell me the use of enabling these rules in snort.conf ?
Lakshmi Balan's user avatar
1 vote
1 answer
1k views

Barnyard 2 install failing on OpenBSD

I'm new to OpenBSD, but I'm having issues with getting Barnyard to install after running the make command. I've ran ./configure and ./configure --with-mysql and both end up with the same error when ...
Nixphoe's user avatar
  • 205
0 votes
1 answer
1k views

Help With PulledPork Please

I have been working to get snort, barnyard2 and pulledpork installed on my Ubuntu machine, and I have the 1st two installed not problem. With pulledpork I cant seem to get past this error message: ...
DHW's user avatar
  • 1
1 vote
0 answers
78 views

How can I simply access a packet's payload and modify it?

I am attempting to access a packet's payload and modify it with a word (let's say Bob). I have a simple tunnel VPN program written in C that displays packets in plain-text. When I connect to a host, ...
huizare's user avatar
  • 11
2 votes
3 answers
5k views

Make: recipe for target 'pcap-bt-monitor-linux.o' failed

I'm following this guide to install snort on my Debian Linux. In step 2 while executing the command 'Make' to build libpcap I'm getting the error 'recipe for target 'pcap-bt-monitor-linux.o' failed' ...
Matteo Pennetta's user avatar
3 votes
1 answer
10k views

libdnet is installed but can't be found by snort

I'm running Fedora 22 and just installed snort: sudo dnf install snort When trying to run it I get: $ snort snort: error while loading shared libraries: libdnet.1: cannot open shared object file: ...
Juicy's user avatar
  • 3,825
4 votes
1 answer
7k views

Snort PCAP file analysing doesn't write to alert file

I'm using snort in my ubuntu 14.04 virtual machine. This is how I installed snort. sudo apt-get update sudo apt-get install snort I haven't change /etc/snort/snort.conf or rules file. They remain as ...
A.M.N.Bandara's user avatar
6 votes
3 answers
15k views

What's the most effective way to detect nmap scans?

I am interested in detecting any nmap scans directed on a (my) GNU/Linux host. I would like to use snort in combination with barnyard2 and snorby for this, or if possible to perform a signature-based ...
niemal010's user avatar
2 votes
1 answer
5k views

Got the "ERROR: Cannot decode data link type 239" message when turn on sniffer mode

I would like install snort 2.9.6 into Centos 7 the installation is ok and the result of the self-testing mode is correct but when I run this command to change Snort into sniffer or nids mode. I got ...
thsecmaniac's user avatar
0 votes
3 answers
3k views

How to start the Snort service with logging enabled?

I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created ...
SLYN's user avatar
  • 1
0 votes
1 answer
8k views

Cannot install Snort 2.9.6.1 due to "Not a compatible architecture"

I have Centos 6.5 installed on a Dell Inspirion Intel chip. When I entered uname -a I got Linux family.room 2.6.32-431.el6.i686 #1 SMP Fri Nov 22 00:26:36 UTC 2013 i686 i686 i386 GNU/Linux I ...
OtagoHarbour's user avatar
1 vote
1 answer
697 views

How to install 64 Bit snort on 64 Bit openSUSE 13.1?

My question is simple: I would like to install 64 Bit snort on my 64 Bit openSUSE 13.1. There is an unstable package available here:http://software.opensuse.org/package/snort I got everything but ...
alpham8's user avatar
  • 61
3 votes
1 answer
17k views

Resolve dependencies installing rpm packages

I am using RHEL6 Hi i have created the yum repository, i downloaded the snort rpm package from their website when i tried to install the rpm its thorws error e.g. snort-2.9.5.3-1.f18.i386.rpm 1:...
thegreatone's user avatar
1 vote
1 answer
2k views

Read snort.u2 files

I am just getting started with learning and testing snort. I have some snort data in snort.u2.timestamp files. What is the best way to view / read these files? I have found some info via Google ...
user695752's user avatar
1 vote
1 answer
357 views

Blocking gzip HTTP content with Iptables or Snort?

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
Coffeee's user avatar
  • 11