The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
2answers
708 views

Error While Running Snort

I have been trying to get snort IDS to work, but I having some difficulty. When I run snort -c /etc/snort/snort.conf -l /var/log/snort I keep getting this error. Initializing rule chains... Warning: ...
1
vote
1answer
82 views

Snort 2.9.6 doesn't alert with VRT ruleset but with ETOpen

I have subscribed to Snort VRT and received the latest rule set (snortrules-snapshot-2956.tar.gz), I installed snort from source using (http://www.snort.org/assets/158/snortinstallguide293.pdf) guide ...
1
vote
1answer
485 views

Snort email rule to alert about any email from a specific user

I am new to snort rules and need a rule that will alert any email from a specific user.. For example: alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"email@thatemail.com"; ...
0
votes
1answer
26 views

How to start the Snort service with logging enabled?

I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created ...
0
votes
1answer
239 views

Snort error on FreeBSD-9: Unknown preprocessor “ftp_telnet”

I've installed "Snort" on FreeBSD-9.1 (32-bit) from the standard ports using: pkg_add -r snort After configuring and running with: snort -c /etc/snort/snort.conf -A full -u snort -g snort -i em1 ...
0
votes
1answer
477 views

Snort install issue on debian 6 with libpcre - libpcre library not found

I've read the manual on snort.org for installing snort on Debian but am still having an issue. Does anyone know how to resolve this? I've tried installing the libpcre3 amd libpcre3-dev packages by ...
0
votes
0answers
19 views

barnyard2 dead but subsys locked - error

I installed snort and barnyard. When I start the snort service and barnyard service, initially they work. After a while barnyard service give an error. Initially: [root@- snort]# service barnyard2 ...
0
votes
0answers
38 views

Snort 2.9.6.0 to detect malicious nfs traffic

I have a snort inline mode IPS.I wanted this IPS to detect malicious nfs traffic.Can anyone please help me out to describe rules that catches the suspicious "nfs" traffic,not allowing it and allow the ...
0
votes
0answers
124 views

Snort installation - pfsense

When I enable the blocking functionality of snort it blocks a lot of legitimate traffic. Yesterday I enabled it and it blocked www.google.ca from working. Anyone have a good set-up that worked for ...
0
votes
0answers
221 views

Snort smtp rule detect given text

Very new and just learning some snort rules but looking to get a rule which looks for content of an email which contains the word test just for an example. alert tcp any 25 -> any any (msg:"test ...
0
votes
0answers
26 views

Unitialized constant SnorbyController

I've installed Snorby 2.6.2 web application with apache2, ruby1.9.3 on Debian 7.1.0 Wheezy and I installed passenger apache2 module for it and configured apache2 for snorby but when I go into the app ...