The tag has no usage guidance.

learn more… | top users | synonyms

1
vote
1answer
143 views

openwrt using iptables with tee seems broken

I've been trying to set up port mirroring on openwrt version 14.07 following this guide: however the command: $iptables -t mangle -A POSTROUTING -o br-lan ! -s 192.168.0.0/16 -j TEE --gateway ...
1
vote
1answer
238 views

Snort 2.9.6 doesn't alert with VRT ruleset but with ETOpen

I have subscribed to Snort VRT and received the latest rule set (snortrules-snapshot-2956.tar.gz), I installed snort from source using (http://www.snort.org/assets/158/snortinstallguide293.pdf) guide ...
1
vote
1answer
1k views

Snort email rule to alert about any email from a specific user

I am new to snort rules and need a rule that will alert any email from a specific user.. For example: alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"email@thatemail.com"; ...
0
votes
1answer
14 views

How to Edit /etc/snort/snort.conf on Mac os x

Configuration 1-Copy the default configuration file from the package into the /etc/snort directory: cp ./etc/* /etc/snort/ 2-Edit /etc/snort/snort.conf and make the following changes: var ...
0
votes
1answer
36 views

Snort wont trigger alert from tap interface eth0

I have snort set up on a raspberry pi running a modified Ubuntu. Between my modem and router I have a switch that mirrors all the traffic to a port that is connected to the eth0 interface on my ...
0
votes
1answer
79 views

How to get details- like Remote ip- about alert genrated by suricata after scanning pcap file

I wanted to test security of my android phone so I leaved it for one day running tcpdump in the background. Then I send resulting pcap to virustotal.com. They are scanning pcap file using snort and ...
0
votes
1answer
163 views

Snorby with PostgreSQL installation issue in Mac OS X 10.10.2 (Yosemite)

Trying to setup Snorby for Snort with PostgreSQL on Mac OS X 10.10.2 (Yosemite) Snort 2.9.7.2 GRE (Build 177) PostgreSQL 9.4.1 ruby 1.9.3p551 (2014-11-13 revision 48407) [x86_64-darwin14.1.0] ...
0
votes
1answer
878 views

Barnyard2 error on start

Been setting up a snort box with barnyard2, run into the error below. Can someone please help? $Starting Snort Output Processor (barnyard2): ./barnyard2: 35: ./barnyard2: barnyard2: not found ...
0
votes
1answer
154 views

How to start the Snort service with logging enabled?

I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created ...
0
votes
1answer
685 views

Snort error on FreeBSD-9: Unknown preprocessor “ftp_telnet”

I've installed "Snort" on FreeBSD-9.1 (32-bit) from the standard ports using: pkg_add -r snort After configuring and running with: snort -c /etc/snort/snort.conf -A full -u snort -g snort -i em1 ...
0
votes
1answer
690 views

Snort install issue on debian 6 with libpcre - libpcre library not found

I've read the manual on snort.org for installing snort on Debian but am still having an issue. Does anyone know how to resolve this? I've tried installing the libpcre3 amd libpcre3-dev packages by ...
0
votes
0answers
3 views

How to detect packet with specific “Total Length” or “Header Length” using Snort?

I'm using Snort to tutorial purposes. As you may know, it brings different rules available for the user to detect different types of transmission packets. The question is that I don't find any ...
0
votes
0answers
46 views

How to detect and alert automatically ARP Poisoning on OSX?

As the Title, I seen various tool with function to detect the Arp Poisoning but nothing of them alerts with message popup or other on OSX. What is the tool that programmatically, every X minute, ...
0
votes
0answers
31 views

Run script after Suricata drops or alarms

I have a Suricata IPS. I want after droping some packets, block their IP in my other servers. I have the command needed to block them. I just don't know how to parse new lines at fast.log and ...
0
votes
0answers
76 views

Snort IDS Network Toplogy

I have a network at work, running a domain controller for several workstations and a NAS. All this is behind a Fortigate 100D which has some IPS functionality and is a solid firewall. But I want to ...