Collaborate Disseminate
A private network (about 150 PCs) is connected to the internet through an edge router. According to the net admin, his network is scanned from the outside, at the edge router. I don’t have any more information.
What’s is the best method t… Continue reading Advice to detect suspicious activities on network [closed]
I am trying to get the sfportscan preprocessor to log SYN port probing but it does not appear to be operating correctly.
I have a .pcap file with portscan traffic which can be seen in wireshark using the filter:
( tcp.flags… Continue reading Snort sfportscan preprocessor not logging port scans correctly
I have a PCAP file from CICIDS, and what I’d like to know is how can I apply the Snortrule in Windows? I’ve not written any custom rules myself but want to run the rules already available. For now, the snort.rules file is emp… Continue reading How to run a snort rule over PCAP file in Windows?
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood – SSH”; flags:S;
flow: stateless; detection_filter: track by_dst, count 40, seconds 10;
GID:1; sid:10000002; … Continue reading Snort rule for syn flood attacks – Limiting number of alerts
A security company was able to track command and control traffic generated by hacking groups thanks to an anomaly in a pen-testing tool. Continue reading Anomaly in pen-test tool made malware servers visible
I’m wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match(“/select/i”, $input)) {
attack_log(“Possible SELECT SQLi detec… Continue reading Is it possible to detect 100% of SQLi with a simple regex?
Can Snort be directly used for monitoring and analyzing wireless traffic?
Continue reading Can Snort be used for monitoring Wireless traffic? [on hold]
Can an IDS, like snort, be used to detect Layer 2 network frames from a system i.e a system is trying to send a frame to the AP and whether Snort can work on the frame based on the rules?
I know that they can detect traffic by rules, but can they modify packets on the go?
For example, not only detecting HTTP GET but also adding headers to the GET packet.
If they can’t, is there an open source program that ca… Continue reading Can Snort or Suricata *edit* packet on the fly?
Using the learning platform, the subject is Snort rules.
Question is:
Create a snort rule that will alert on traffic with destination ports 443 and 447.
My attempts:
alert tcp any any -> any 443 447 ( msg:"Sample alert"; si… Continue reading Create a snort rule that will alert on traffic on ports 443 & 447