Questions tagged [snort]

Snort is an open source intrusion prevention system which capable of real-time traffic analysis and packet logging.

0
votes
1answer
36 views

Snort 2.9.13 Error: Cant start DAQ (-1) --> Fatal Error quiting

I have installed Snort 2.9.13 on Windows 10. When I try to check the interfaces with Snort -W, it doesn't show any. However, using Windows' ipconfig they are visible. When I test Snort using snort -i ...
0
votes
0answers
7 views

Ubuntu 18.04 snort protection

Recently I installed Snort on my Ubuntu server 18.04 And also wrote some rules in local.rules . it will perfectly detect my rules like ping , simple dos attacks etc. I have 4 questions : How can i ...
0
votes
0answers
15 views

Snort installed but no pre-processors configured for policy 0

Hi I have installed snort 2.9.11.1 using home-brew for Mac however I received a warning that there are no pre-processors configured for policy 0. How should I continue to configure my install for ...
0
votes
0answers
17 views

How to calculate/measure throughput of firewall like snort or suricata IPS

i have a running IPS/IDS on access point, all traffic is going from this access point. Now is there any way or tool that calculate the throughput of this IPS/IDS. Thanks in advance.
0
votes
1answer
41 views

Manjaro Linux snort installation : ERROR! dnet header not found

I want to install snort on Manjaro Linux. snort is not available on pacman and I tried to install via code below. pamac build snort I am getting this error ERROR! dnet header not found, go get it ...
0
votes
0answers
46 views

Snort will not write output to a csv file

Hell all. I have snort (version 2.9.11.1) up and running in my linux environment. I am able to generate alerts, but they are being written to a file named "alert" and another file named "snort.log....
1
vote
0answers
317 views

Snort can’t start and says it failed to parse the IP address: 8.0.0.0/8.0.0.0

I need to use Snort in Windows. I've done the configuration several times but no luck. Snort always returns output like this The Snort configuration file can be found here on Google Drive.
0
votes
1answer
84 views

Custom Snort rule prevent me from starting the WAN interface

I'm having an issue where when I add a custom rule to my WAN interface(SNORT), I can't start the interface, not even the simplest ping rules work now despite having worked just fine all day. Trouble ...
0
votes
1answer
296 views

Configuring virtual network interface as sniffing interface

I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
1
vote
0answers
35 views

Configuring virtual network interface as sniffing interface

I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
0
votes
1answer
2k views

Snort finding the alert file DATA with snort.logs.xxxxxxx

I'am working on task where my security team is asking me to provide a pcap file under the folder /var/log/snort. They have picked up a source IPADDRESS from an alert file and they need to do more ...
0
votes
0answers
78 views

Snort Cannot send alert to database

I have some problem with Snort on Ubuntu server 14.04 I don't know why, if my server going down because the electricity going down and if Iam add some table or add privilages on Snort database(mysql), ...
1
vote
1answer
483 views

fwsnort won't apply rules in iptables

I'm using Debian 8, and I want to update fwsnort rules through this command: fwsnort --update-rules Though after downloading 9.4 MB of rules in '/etc/fwsnort/snort_rules/emerging-all.rules' file, it ...
0
votes
1answer
1k views

Snort 'make install' error on Linux

I'm trying to install Snort on Debian and I get this error after 'make install': make[6]: Nothing to be done for 'install-exec-am'. /bin/mkdir -p '/usr/local/lib/snort_dynamicengine' /bin/bash ../....
0
votes
1answer
514 views

Snort running with pfSense

First of all, I am sorry about my English skill. I have a topology and I want to integrate the Snort with pfSense. Can pfSense auto add firewall rules when Snort alert? Does pfSense have function to ...
0
votes
1answer
175 views

snort installation on windows : missing database config line in snort.conf

I installed Snort on windows 7, and added all the rules and everything works fine for me. The thing that I want to add, is to save alerts in mysql database, in my case, in some tutorials that I found ...
1
vote
0answers
33 views

How can I autonomously dump/push the AP logs from the assortment of devices without logging into each?

I am running an AWS OpenVPN EC2 server providing a VPN for mobile devices. Additionally, I am managing an OpenWRT in my house, an ISP provided Linksys in another state, and a mid-grade Cisco Aironet ...
-1
votes
1answer
58 views

Bash: I want to count letters and substitute text

OK so I'm extremely new to bash shell scripting and I've been pretty successful up until this point. I'm using BASH to fix a problem... I want to turn a basic domain name: Buddies.forlife.com into |...
0
votes
2answers
698 views

How can I type “Edit /etc/snort/snort.conf ” in Mac terminal?

Please help me with: Configuration: Copy the default configuration file from the package into the /etc/snort directory: cp ./etc/* /etc/snort/ Edit /etc/snort/snort.conf and make the ...
0
votes
1answer
713 views

How to Edit /etc/snort/snort.conf on Mac os x

Configuration 1-Copy the default configuration file from the package into the /etc/snort directory: cp ./etc/* /etc/snort/ 2-Edit /etc/snort/snort.conf and make the following changes: var ...
0
votes
0answers
311 views

How to detect and alert automatically ARP Poisoning on OSX?

As the Title, I seen various tool with function to detect the Arp Poisoning but nothing of them alerts with message popup or other on OSX. What is the tool that programmatically, every X minute, ...
0
votes
1answer
748 views

Snort/Barnyard2 Wont compile on Raspberry Pi with Ubuntu

I've been following this Guide to install snort and barnyard. When I try to configure barnyard I get this error. /usr/local/include/dnet.h:22:23: fatal error: dnet/sctp.h: No such file or directory ...
0
votes
1answer
189 views

Snort wont trigger alert from tap interface eth0

I have snort set up on a raspberry pi running a modified Ubuntu. Between my modem and router I have a switch that mirrors all the traffic to a port that is connected to the eth0 interface on my ...
0
votes
1answer
470 views

Compiling Snort for OpenWRT

I'm trying to install Snort on an OpenWRT VM. I followed the instructions on the Snort homepage and it looks like it requires the make tool for compiling the code: ./configure --enable-sourcefire; ...
2
votes
2answers
3k views

Home Network Setup to Monitor Traffic via Snort

I have a decent background in linux, however, I severely misunderstand networking fundamentals. I am trying to set up a home environment where my Virtual Box RedHat box monitors all the traffic on my ...
1
vote
1answer
818 views

Snort installed on Ubuntu not sending alerts to syslog

I have a Magento website setup on a Linux machine that is based on a Bitnami ready-made image. The main goal is to be notified by email whenever there might be a potential attack on the site. My ...
1
vote
1answer
807 views

openwrt using iptables with tee seems broken

I've been trying to set up port mirroring on openwrt version 14.07 following this guide: however the command: $iptables -t mangle -A POSTROUTING -o br-lan ! -s 192.168.0.0/16 -j TEE --gateway 192....
1
vote
1answer
230 views

Are these Snort rules redundant?

I was looking through the community.rules made available on the Snort web page, and noticed these two rules: Rule @ line 2643: alert udp $HOME_NET any -> any 53 (msg:"BLACKLIST DNS request for ...
0
votes
1answer
445 views

Snort Failing to start on Ubuntu 9.04

EDIT: Hey! To anyone stumbling across this question who followed this guide: https://help.ubuntu.com/community/SnortIDS It's too old and WILL NOT work! Find a different one! I'm trying to get Snort ...
0
votes
1answer
148 views

How to get details- like Remote ip- about alert genrated by suricata after scanning pcap file

I wanted to test security of my android phone so I leaved it for one day running tcpdump in the background. Then I send resulting pcap to virustotal.com. They are scanning pcap file using snort and ...
3
votes
1answer
256 views

Retaining origin when using Snort with a loadbalancer? Or why it's a bad idea?

Initially I deployed HAProxy so that it would be possible to notice bad traffic going into my web server (rather than it being obscured by TLS), but now I noticed the rather obvious problem that once ...
0
votes
1answer
390 views

Snorby with PostgreSQL installation issue in Mac OS X 10.10.2 (Yosemite)

Trying to setup Snorby for Snort with PostgreSQL on Mac OS X 10.10.2 (Yosemite) Snort 2.9.7.2 GRE (Build 177) PostgreSQL 9.4.1 ruby 1.9.3p551 (2014-11-13 revision 48407) [x86_64-darwin14.1.0] Here ...
-2
votes
2answers
15k views

OSX: Snort: ERROR: /etc/snort/../rules/local.rules(0) Unable to open rules file “/etc/snort/../rules/local.rules”: No such file or directory

I'm trying to setup and run Snort IDS on mac using this kinda tutorial: https://discussions.apple.com/thread/3370709?start=0&tstart=0 OSX Yosemite (10.10.2); PostgreSQL 9.4.1 (installed with ...
-1
votes
1answer
3k views

OSX: Postgresql port 5432 is closed. How to open?

Mac OS X Yosemite (10.10.2) Postgresql 9.4.1 (installed with Homebrew) Snort 2.9.7.0 (installed with Homebrew) I can't connect to psql - port 5432 seem to be closed: $ psql postgres psql: could ...
0
votes
0answers
286 views

Snort IDS Network Toplogy

I have a network at work, running a domain controller for several workstations and a NAS. All this is behind a Fortigate 100D which has some IPS functionality and is a solid firewall. But I want to ...
1
vote
1answer
200 views

SNORT -Unknown command line checksum option: ascii

snort -vde -l /var/log/snort -k ascii when i tried this command it gives me the error Unknown command line checksum option: ascii. I don't know why,coz i hve installed snort successfully, and also ...
0
votes
1answer
2k views

Barnyard2 error on start

Been setting up a snort box with barnyard2, run into the error below. Can someone please help? $Starting Snort Output Processor (barnyard2): ./barnyard2: 35: ./barnyard2: barnyard2: not found /etc/...
0
votes
1answer
615 views

barnyard2 dead but subsys locked - error

I installed snort and barnyard. When I start the snort service and barnyard service, initially they work. After a while barnyard service give an error. Initially: [root@- snort]# service barnyard2 ...
0
votes
1answer
792 views

How to start the Snort service with logging enabled?

I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created ...
0
votes
1answer
11k views

Error configuring Snort

I am setting up snort on Windows 8 machine and having trouble with it. I am following the instructions mentioned here: http://www.snort.org/assets/151/Installing_Snort_2.8.6.1_on_Windows_7.pdf On ...
1
vote
1answer
344 views

Snort 2.9.6 doesn't alert with VRT ruleset but with ETOpen

I have subscribed to Snort VRT and received the latest rule set (snortrules-snapshot-2956.tar.gz), I installed snort from source using (http://www.snort.org/assets/158/snortinstallguide293.pdf) guide ...
1
vote
2answers
496 views

Monitoring network traffic via switch access

I'd like to experiment with monitoring my home network traffic and wondering if a particular solution I have in mind will work. I have a pretty standard setup, Verizon FIOS coming in to my house and ...
1
vote
3answers
1k views

Snort error on FreeBSD-9: Unknown preprocessor “ftp_telnet”

I've installed "Snort" on FreeBSD-9.1 (32-bit) from the standard ports using: pkg_add -r snort After configuring and running with: snort -c /etc/snort/snort.conf -A full -u snort -g snort -i em1 -T ...
4
votes
2answers
215 views

wifi router is masking ip addresses

I have a rookie question regarding routing and wifi access points. Background I have a main switch (cisco catalyst 2950) that sits behind my router/firewall. On that switch I have an IDS (snort) ...
3
votes
2answers
4k views

Error While Running Snort

I have been trying to get snort IDS to work, but I having some difficulty. When I run snort -c /etc/snort/snort.conf -l /var/log/snort I keep getting this error. Initializing rule chains... Warning: ...
0
votes
2answers
1k views

Snort install issue on debian 6 with libpcre - libpcre library not found

I've read the manual on snort.org for installing snort on Debian but am still having an issue. Does anyone know how to resolve this? I've tried installing the libpcre3 amd libpcre3-dev packages by ...
5
votes
2answers
4k views

Blocking Skype using snort and iptables

I am trying to block Skype using snort and iptables. I read a lot of papers and blocked the port, keywords and patterns which Skype uses. But it is still not blocked. My question is: if Skype uses ...
1
vote
1answer
2k views

Snort email rule to alert about any email from a specific user

I am new to snort rules and need a rule that will alert any email from a specific user.. For example: alert tcp any any -> any 25 (msg:"Target Email Detected"; content:"email@thatemail.com"; ...