The tag has no wiki summary.

learn more… | top users | synonyms

3
votes
1answer
7 views

Retaining origin when using Snort with a loadbalancer? Or why it's a bad idea?

Initially I deployed HAProxy so that it would be possible to notice bad traffic going into my web server (rather than it being obscured by TLS), but now I noticed the rather obvious problem that once ...
0
votes
0answers
20 views

Snort alerts analysis (web interface)

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
0
votes
0answers
27 views

Please explain the content of my snorby database.yml

I'm trying to reconfigure my Snorby (installed for MySQL) to work with already existing Snort database (Postgres). This is Snorby database.yml file: snorby: &snorby adapter: mysql username: ...
0
votes
0answers
46 views

Snorby with PostgreSQL installation issue in Mac OS X 10.10.2 (Yosemite)

Trying to setup Snorby for Snort with PostgreSQL on Mac OS X 10.10.2 (Yosemite) Snort 2.9.7.2 GRE (Build 177) PostgreSQL 9.4.1 ruby 1.9.3p551 (2014-11-13 revision 48407) [x86_64-darwin14.1.0] ...
-2
votes
1answer
377 views

OSX: Snort: ERROR: /etc/snort/../rules/local.rules(0) Unable to open rules file “/etc/snort/../rules/local.rules”: No such file or directory

I'm trying to setup and run Snort IDS on mac using this kinda tutorial: https://discussions.apple.com/thread/3370709?start=0&tstart=0 OSX Yosemite (10.10.2); PostgreSQL 9.4.1 (installed with ...
-1
votes
1answer
129 views

OSX: Postgresql port 5432 is closed. How to open?

Mac OS X Yosemite (10.10.2) Postgresql 9.4.1 (installed with Homebrew) Snort 2.9.7.0 (installed with Homebrew) I can't connect to psql - port 5432 seem to be closed: $ psql postgres psql: could ...
0
votes
1answer
23 views

Can I set a random/different name to the PostgreSQL database for snort and metasploit etc?

I’m trying to learn PostgreSQL. Sorry, maybe this question sounds silly for advanced database users, but can I give the random name to databases (and users) for Snort and Matasploit instead of ...
0
votes
0answers
27 views

Snort IDS Network Toplogy

I have a network at work, running a domain controller for several workstations and a NAS. All this is behind a Fortigate 100D which has some IPS functionality and is a solid firewall. But I want to ...
1
vote
1answer
30 views

SNORT -Unknown command line checksum option: ascii

snort -vde -l /var/log/snort -k ascii when i tried this command it gives me the error Unknown command line checksum option: ascii. I don't know why,coz i hve installed snort successfully, and also ...
0
votes
1answer
309 views

Barnyard2 error on start

Been setting up a snort box with barnyard2, run into the error below. Can someone please help? $Starting Snort Output Processor (barnyard2): ./barnyard2: 35: ./barnyard2: barnyard2: not found ...
0
votes
0answers
52 views

ERROR: Unknown command line checksum option: ascii

I have run this command in snort on windows 7 : snort -c c:\snort\etc\snort.conf -l c:\snort\log -k ascii but after this it displays the error like this - ERROR: Unknown command line checksum ...
0
votes
0answers
58 views

Barnyard - Database Warning

I installed snort and barnyard. When I start snort and barnyard services, barnyard could read snort.log file but it doesn't write to mysql database. So I run tail -100 /var/log/messages and I ...
0
votes
0answers
223 views

Snort unified log - empty file

I installed snort and configured snort.conf file. Snort is catching packets but not logging. =============================================================================== Memory usage summary: ...
0
votes
0answers
158 views

Barnyard Service - MySQL Error

I installed barnyard2 and saved as a service. When I run service barnyard2 start, Barnyard2 is failed. After I run tail -100 /var/log/messages and I encounter a fault like this. ERROR database: ...
0
votes
0answers
161 views

Snort error on CentOS : Unknown preprocessor “ftp_telnet”

I installed snort on CentOS server. If I use snort -v command, snort is working. If I use snort -c /etc/snort/snort.conf command, snort throw an error. Error message: [root@www snort]# snort -c ...
0
votes
1answer
192 views

barnyard2 dead but subsys locked - error

I installed snort and barnyard. When I start the snort service and barnyard service, initially they work. After a while barnyard service give an error. Initially: [root@- snort]# service barnyard2 ...
0
votes
1answer
108 views

How to start the Snort service with logging enabled?

I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created ...
0
votes
1answer
2k views

Error configuring Snort

I am setting up snort on Windows 8 machine and having trouble with it. I am following the instructions mentioned here: http://www.snort.org/assets/151/Installing_Snort_2.8.6.1_on_Windows_7.pdf On ...
1
vote
1answer
174 views

Snort 2.9.6 doesn't alert with VRT ruleset but with ETOpen

I have subscribed to Snort VRT and received the latest rule set (snortrules-snapshot-2956.tar.gz), I installed snort from source using (http://www.snort.org/assets/158/snortinstallguide293.pdf) guide ...
1
vote
3answers
107 views

Monitoring network traffic via switch access

I'd like to experiment with monitoring my home network traffic and wondering if a particular solution I have in mind will work. I have a pretty standard setup, Verizon FIOS coming in to my house and ...
0
votes
1answer
472 views

Snort error on FreeBSD-9: Unknown preprocessor “ftp_telnet”

I've installed "Snort" on FreeBSD-9.1 (32-bit) from the standard ports using: pkg_add -r snort After configuring and running with: snort -c /etc/snort/snort.conf -A full -u snort -g snort -i em1 ...
4
votes
2answers
122 views

wifi router is masking ip addresses

I have a rookie question regarding routing and wifi access points. Background I have a main switch (cisco catalyst 2950) that sits behind my router/firewall. On that switch I have an IDS (snort) ...
2
votes
2answers
1k views

Error While Running Snort

I have been trying to get snort IDS to work, but I having some difficulty. When I run snort -c /etc/snort/snort.conf -l /var/log/snort I keep getting this error. Initializing rule chains... Warning: ...
0
votes
1answer
592 views

Snort install issue on debian 6 with libpcre - libpcre library not found

I've read the manual on snort.org for installing snort on Debian but am still having an issue. Does anyone know how to resolve this? I've tried installing the libpcre3 amd libpcre3-dev packages by ...
5
votes
2answers
3k views

Blocking Skype using snort and iptables

I am trying to block Skype using snort and iptables. I read a lot of papers and blocked the port, keywords and patterns which Skype uses. But it is still not blocked. My question is: if Skype uses ...
1
vote
1answer
646 views

Snort email rule to alert about any email from a specific user

I am new to snort rules and need a rule that will alert any email from a specific user.. For example: alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"email@thatemail.com"; ...