Questions tagged [snort]

Snort is a free open source network intrusion detection system (IDS) and intrusion prevention system (IPS).

Filter by
Sorted by
Tagged with
0
votes
1answer
44 views

Unable to locate package snort_Kali LInux in VMware Workstation Pro (ver 15.5.6)

Checked answers to the similar question. Still not working for me. Current entries in /etc/apt/sources.list: 1. deb http://http.kali.org/kali kali-rolling main non-free contrib 2. deb http://http.kali....
0
votes
1answer
406 views

Unable to locate package snort

I am having problem with installing snort on Kali. I used the command: sudo apt-get install snort -y but it replies only that unable to locate the package error. I did upgrade, update, edit sources....
0
votes
0answers
20 views

Load balancing packets from interface to many virtual interfaces

I've got a server with interface eth0. I'm using a black-box software (SNORT) that gets as input an interface and using a single thread analyze the packets' data. I wish to increase the throughput ...
0
votes
1answer
42 views

Does intrusion detection system(IDS) make sense on a firewalled web-server?

I'm running Apache on a server with stateful firewall where new IPv4/IPv6 ingress connections are allowed only to TCP ports 80 and 443. SSH is allowed from few trusted hosts and only certain ICMP/...
1
vote
0answers
734 views

How to monitor system with `snort` and send emails about `alerts`

PROBLEM: I have been configuring snort on my systems and would like to get emails from the systems if there are any alerts. What I have tried is swatch but I can't find much documentation on it, can ...
0
votes
1answer
53 views

Log file extract data and append back same line

I have a snort.rule file, I need to extract cve numbers followed by reference key from the line and append them back in msg field of the same line inside flower brackets, below is the old log. ...
1
vote
0answers
38 views

Match SNORT IP alerts to specific URLs

I have SNORT running on an Ubuntu 18.04 server. I have alerts firing off but the alert logs come through as IP addresses. I have a list of websites the system has visited throughout the day. Is ...
1
vote
1answer
1k views

barnyard missing SID msg map file from snort

I installed snort (currently ver. 2.9.7.0-5) then compiled Barnyard2 Version 2.1.14 (Build 337). At first try with: sudo ./barnyard2 -c ../etc/barnyard2.conf -o /var/log/snort/snort.alert I get ...
1
vote
0answers
68 views

Limiting concurrent connections from a particular host to a particular host on a particular port?

I am trying to find a way to stop port scans or DoS type activities from within the network to external resources so I can reduce the number of abuse complaints. While I know there are numerous tools ...
1
vote
1answer
263 views

How to generate network traffic and save it to pcap files?

I want to test snort, so I want to have some test network traffic. Since snort can read pcap files, I want to generate some traffics which can be customized and save it to pcap files. Here are my ...
0
votes
1answer
411 views

Use of decoder.rules & preproc.rules in Snort

I am working with snort. While configuring I have come across rule files such as decoder.rules and preproc.rules. Can any one please tell me the use of enabling these rules in snort.conf ?
1
vote
1answer
770 views

Barnyard 2 install failing on OpenBSD

I'm new to OpenBSD, but I'm having issues with getting Barnyard to install after running the make command. I've ran ./configure and ./configure --with-mysql and both end up with the same error when ...
0
votes
1answer
987 views

Help With PulledPork Please

I have been working to get snort, barnyard2 and pulledpork installed on my Ubuntu machine, and I have the 1st two installed not problem. With pulledpork I cant seem to get past this error message: ...
1
vote
0answers
60 views

How can I simply access a packet's payload and modify it?

I am attempting to access a packet's payload and modify it with a word (let's say Bob). I have a simple tunnel VPN program written in C that displays packets in plain-text. When I connect to a host, ...
2
votes
3answers
5k views

Make: recipe for target 'pcap-bt-monitor-linux.o' failed

I'm following this guide to install snort on my Debian Linux. In step 2 while executing the command 'Make' to build libpcap I'm getting the error 'recipe for target 'pcap-bt-monitor-linux.o' failed' ...
3
votes
1answer
7k views

libdnet is installed but can't be found by snort

I'm running Fedora 22 and just installed snort: sudo dnf install snort When trying to run it I get: $ snort snort: error while loading shared libraries: libdnet.1: cannot open shared object file: ...
4
votes
1answer
4k views

Snort PCAP file analysing doesn't write to alert file

I'm using snort in my ubuntu 14.04 virtual machine. This is how I installed snort. sudo apt-get update sudo apt-get install snort I haven't change /etc/snort/snort.conf or rules file. They remain as ...
4
votes
3answers
11k views

What's the most effective way to detect nmap scans?

I am interested in detecting any nmap scans directed on a (my) GNU/Linux host. I would like to use snort in combination with barnyard2 and snorby for this, or if possible to perform a signature-based ...
2
votes
1answer
4k views

Got the “ERROR: Cannot decode data link type 239” message when turn on sniffer mode

I would like install snort 2.9.6 into Centos 7 the installation is ok and the result of the self-testing mode is correct but when I run this command to change Snort into sniffer or nids mode. I got ...
0
votes
3answers
2k views

How to start the Snort service with logging enabled?

I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created ...
0
votes
1answer
4k views

Cannot install Snort 2.9.6.1 due to “Not a compatible architecture”

I have Centos 6.5 installed on a Dell Inspirion Intel chip. When I entered uname -a I got Linux family.room 2.6.32-431.el6.i686 #1 SMP Fri Nov 22 00:26:36 UTC 2013 i686 i686 i386 GNU/Linux I ...
1
vote
1answer
615 views

How to install 64 Bit snort on 64 Bit openSUSE 13.1?

My question is simple: I would like to install 64 Bit snort on my 64 Bit openSUSE 13.1. There is an unstable package available here:http://software.opensuse.org/package/snort I got everything but ...
3
votes
1answer
16k views

Resolve dependencies installing rpm packages

I am using RHEL6 Hi i have created the yum repository, i downloaded the snort rpm package from their website when i tried to install the rpm its thorws error e.g. snort-2.9.5.3-1.f18.i386.rpm 1:...
1
vote
1answer
2k views

Read snort.u2 files

I am just getting started with learning and testing snort. I have some snort data in snort.u2.timestamp files. What is the best way to view / read these files? I have found some info via Google ...
1
vote
1answer
305 views

Blocking gzip HTTP content with Iptables or Snort?

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?