1

I have subscribed to Snort VRT and received the latest rule set (snortrules-snapshot-2956.tar.gz), I installed snort from source using (http://www.snort.org/assets/158/snortinstallguide293.pdf) guide for Ubuntu 12.04 LTS.

I found snort does not alert on sample malicious requests i.e. DT to ../../../etc/passwd, curl www.testmyids.com, portscan using VRT ruleset. So then I added ETOpen ruleset and it started to alert on the above requests (curl www.testmyids.com, sample ping in local.rules, DNS attack):

04/03-11:32:47.780946  [**] [1:2100498:8] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} X.X.X.X:80 -> Y.Y.Y.Y:44591
04/03-11:47:28.034106  [**] [1:10000001:0] ICMP test [**] [Priority: 0] {ICMP} X.X.X.X -> Y.Y.Y.Y
04/03-12:01:12.771472  [**] [1:2016016:6] ET CURRENT_EVENTS DNS Amplification Attack Inbound [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} X.X.X.X:39613 -> Y.Y.Y.Y:53

As it is a first time I am using VRT (I used ET before and worked quite well),

  • is this a normal behavior not to alert on the above events?
  • if not, is there any configuration I need to set for VRT to work? here is my snort.conf

1 Answer 1

0

alerting depends on the rule(sets) loaded; VRT is different from ET and are shipping different rules; they share a common set of open vrt-rules though

so when one ruleset loaded is alerting, and the other not, your should adjust your ruleset.

for further questions i'd like to direct you to the snort-mailing-list, becuase this is a configuration/understanding-how-it-works-issue :)

1
  • Thanks for the pointer on mailing list, I copied the question over there. VRT by itself has not alerted on any sample request that I manually generated even now when the host is publicly facing (at there are sheer load of attempts). Once I added ET, ET started to pick up events. If as you said, VRT lacks or does not have those of ET, then thats is serious false-negatives!
    – ESuser
    Apr 4, 2014 at 11:44

You must log in to answer this question.