Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [snort]

The tag has no usage guidance.

1
vote
0answers
42 views

How to monitor system with `snort` and send emails about `alerts`

PROBLEM: I have been configuring snort on my systems and would like to get emails from the systems if there are any alerts. What I have tried is swatch but I can't find much documentation on it, can ...
0
votes
1answer
47 views

Log file extract data and append back same line

I have a snort.rule file, I need to extract cve numbers followed by reference key from the line and append them back in msg field of the same line inside flower brackets, below is the old log. ...
1
vote
0answers
28 views

Match SNORT IP alerts to specific URLs

I have SNORT running on an Ubuntu 18.04 server. I have alerts firing off but the alert logs come through as IP addresses. I have a list of websites the system has visited throughout the day. Is ...
1
vote
1answer
805 views

barnyard missing SID msg map file from snort

I installed snort (currently ver. 2.9.7.0-5) then compiled Barnyard2 Version 2.1.14 (Build 337). At first try with: sudo ./barnyard2 -c ../etc/barnyard2.conf -o /var/log/snort/snort.alert I get ...
1
vote
0answers
58 views

Limiting concurrent connections from a particular host to a particular host on a particular port?

I am trying to find a way to stop port scans or DoS type activities from within the network to external resources so I can reduce the number of abuse complaints. While I know there are numerous tools ...
1
vote
0answers
189 views

How to generate network traffic and save it to pcap files?

I want to test snort, so I want to have some test network traffic. Since snort can read pcap files, I want to generate some traffics which can be customized and save it to pcap files. Here are my ...
0
votes
1answer
342 views

Use of decoder.rules & preproc.rules in Snort

I am working with snort. While configuring I have come across rule files such as decoder.rules and preproc.rules. Can any one please tell me the use of enabling these rules in snort.conf ?
1
vote
1answer
544 views

Barnyard 2 install failing on OpenBSD

I'm new to OpenBSD, but I'm having issues with getting Barnyard to install after running the make command. I've ran ./configure and ./configure --with-mysql and both end up with the same error when ...
0
votes
1answer
979 views

Help With PulledPork Please

I have been working to get snort, barnyard2 and pulledpork installed on my Ubuntu machine, and I have the 1st two installed not problem. With pulledpork I cant seem to get past this error message: ...
1
vote
0answers
51 views

How can I simply access a packet's payload and modify it?

I am attempting to access a packet's payload and modify it with a word (let's say Bob). I have a simple tunnel VPN program written in C that displays packets in plain-text. When I connect to a host, ...
2
votes
3answers
4k views

Make: recipe for target 'pcap-bt-monitor-linux.o' failed

I'm following this guide to install snort on my Debian Linux. In step 2 while executing the command 'Make' to build libpcap I'm getting the error 'recipe for target 'pcap-bt-monitor-linux.o' failed' ...
1
vote
1answer
5k views

libdnet is installed but can't be found by snort

I'm running Fedora 22 and just installed snort: sudo dnf install snort When trying to run it I get: $ snort snort: error while loading shared libraries: libdnet.1: cannot open shared object file: ...
3
votes
1answer
2k views

Snort PCAP file analysing doesn't write to alert file

I'm using snort in my ubuntu 14.04 virtual machine. This is how I installed snort. sudo apt-get update sudo apt-get install snort I haven't change /etc/snort/snort.conf or rules file. They remain as ...
4
votes
3answers
10k views

What's the most effective way to detect nmap scans?

I am interested in detecting any nmap scans directed on a (my) GNU/Linux host. I would like to use snort in combination with barnyard2 and snorby for this, or if possible to perform a signature-based ...
2
votes
1answer
3k views

Got the “ERROR: Cannot decode data link type 239” message when turn on sniffer mode

I would like install snort 2.9.6 into Centos 7 the installation is ok and the result of the self-testing mode is correct but when I run this command to change Snort into sniffer or nids mode. I got ...
0
votes
3answers
2k views

How to start the Snort service with logging enabled?

I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created ...
0
votes
1answer
3k views

Cannot install Snort 2.9.6.1 due to “Not a compatible architecture”

I have Centos 6.5 installed on a Dell Inspirion Intel chip. When I entered uname -a I got Linux family.room 2.6.32-431.el6.i686 #1 SMP Fri Nov 22 00:26:36 UTC 2013 i686 i686 i386 GNU/Linux I ...
1
vote
1answer
596 views

How to install 64 Bit snort on 64 Bit openSUSE 13.1?

My question is simple: I would like to install 64 Bit snort on my 64 Bit openSUSE 13.1. There is an unstable package available here:http://software.opensuse.org/package/snort I got everything but ...
3
votes
1answer
16k views

Resolve dependencies installing rpm packages

I am using RHEL6 Hi i have created the yum repository, i downloaded the snort rpm package from their website when i tried to install the rpm its thorws error e.g. snort-2.9.5.3-1.f18.i386.rpm 1:...
1
vote
1answer
2k views

Read snort.u2 files

I am just getting started with learning and testing snort. I have some snort data in snort.u2.timestamp files. What is the best way to view / read these files? I have found some info via Google ...
1
vote
1answer
290 views

Blocking gzip HTTP content with Iptables or Snort?

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?