The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
1answer
38 views

openwrt using iptables with tee seems broken

I've been trying to set up port mirroring on openwrt version 14.07 following this guide: however the command: $iptables -t mangle -A POSTROUTING -o br-lan ! -s 192.168.0.0/16 -j TEE --gateway ...
1
vote
1answer
198 views

Snort 2.9.6 doesn't alert with VRT ruleset but with ETOpen

I have subscribed to Snort VRT and received the latest rule set (snortrules-snapshot-2956.tar.gz), I installed snort from source using (http://www.snort.org/assets/158/snortinstallguide293.pdf) guide ...
1
vote
1answer
756 views

Snort email rule to alert about any email from a specific user

I am new to snort rules and need a rule that will alert any email from a specific user.. For example: alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"email@thatemail.com"; ...
0
votes
1answer
34 views

How to get details- like Remote ip- about alert genrated by suricata after scanning pcap file

I wanted to test security of my android phone so I leaved it for one day running tcpdump in the background. Then I send resulting pcap to virustotal.com. They are scanning pcap file using snort and ...
0
votes
1answer
106 views

Snorby with PostgreSQL installation issue in Mac OS X 10.10.2 (Yosemite)

Trying to setup Snorby for Snort with PostgreSQL on Mac OS X 10.10.2 (Yosemite) Snort 2.9.7.2 GRE (Build 177) PostgreSQL 9.4.1 ruby 1.9.3p551 (2014-11-13 revision 48407) [x86_64-darwin14.1.0] ...
0
votes
1answer
510 views

Barnyard2 error on start

Been setting up a snort box with barnyard2, run into the error below. Can someone please help? $Starting Snort Output Processor (barnyard2): ./barnyard2: 35: ./barnyard2: barnyard2: not found ...
0
votes
1answer
122 views

How to start the Snort service with logging enabled?

I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created ...
0
votes
1answer
545 views

Snort error on FreeBSD-9: Unknown preprocessor “ftp_telnet”

I've installed "Snort" on FreeBSD-9.1 (32-bit) from the standard ports using: pkg_add -r snort After configuring and running with: snort -c /etc/snort/snort.conf -A full -u snort -g snort -i em1 ...
0
votes
1answer
625 views

Snort install issue on debian 6 with libpcre - libpcre library not found

I've read the manual on snort.org for installing snort on Debian but am still having an issue. Does anyone know how to resolve this? I've tried installing the libpcre3 amd libpcre3-dev packages by ...
0
votes
0answers
115 views

How to check if logstash receiving/parsing data from suricata to elasticsearch?

Trying to configure suricata v2.0.8 with ElasticSearch(v1.5.2)-Logstash(v1.4.2)-Kibana(v4.0.2) on Mac OS X 10.10.3 Yosemite. suricata.yaml: # Extensible Event Format (nicknamed EVE) event log in ...
0
votes
0answers
59 views

Can Suricata be configured to work as IPS (not only as IDS) on Mac OS X?

Does anyone here successfully use Suricata in IPS mode on OSX? Is it possible at all? I've spent a few days trying to configure sourcecode in different ways with --enable-nfqueue option but with no ...
0
votes
0answers
83 views

Snort alerts analysis (web interface)

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
0
votes
0answers
45 views

Snort IDS Network Toplogy

I have a network at work, running a domain controller for several workstations and a NAS. All this is behind a Fortigate 100D which has some IPS functionality and is a solid firewall. But I want to ...
0
votes
0answers
74 views

ERROR: Unknown command line checksum option: ascii

I have run this command in snort on windows 7 : snort -c c:\snort\etc\snort.conf -l c:\snort\log -k ascii but after this it displays the error like this - ERROR: Unknown command line checksum ...