Collaborate Disseminate
Can anyone tell me what is happening here step by step:
# This text file shows a collection of log entries from the NIDS and one of the hosts on the network
# Only relevant entries are shown
#
1. 14:45:05:47. Packet from 62.8.1.2 to 102.8… Continue reading Nids log files step by step [closed]
Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud.
Assuming that I have a fully "serverless" AWS environment consisting only of Lambdas… Continue reading Why do I need an IDS/IPS in a serverless cloud environment?
Implying I were to use port mirroring, would it increase my network’s jitter/ping and other networking matters?
I’m using a local DNS server/forwarder, would it cause any issues?
Continue reading Do IDS/IPS/HIDS slow your network down? [migrated]
I know that port scanning can set off IDS systems on certain networks due to the suspicious traffic it generates. Can the usage of Wireshark be detected on a network? If so, will using it set off any alert systems, and can it be traced bac… Continue reading Can the usage of Wireshark be detected when sniffing for packets in promiscuous mode? [duplicate]
I have a partner that is asking "Do you use breach detection/prevention tools?".
I host my service on managed hosting (Heroku) and currently migrating to Google Cloud. Should I be using "breach detection/prevention tools&quo… Continue reading Are IDS/IPS already implemented on Google Cloud?
I’m in my last year of university and for my honour’s project I am tasked with comparing two intrusion detection systems, snort and suricata, hosted on a virtual machine on my PC.
As I have no access to networking devices such as switches … Continue reading What is the best way to create a PCAP file containing malicious traffic?
I`m trying to execute YAIDS (installed on ubuntu with quickinstall script) regarding to the general documentation usage in order to analyse a malicious pcap file with the standard ruleset of index.yar from the official rules-master reposit… Continue reading YAIDS execution error without further error log information
How do you figure out Snort’s source & destination IP and port if the question is so vague? For example:
Write a snort rule that detects a UK NI number sent from a client’s web browser to a web server.
I understand how to write the reg… Continue reading How to determine Snort rules source & destination IP and port
I can’t figure it out / understand. Need to write a rule that catches an HTTP POST request from one ip address more than three times in 10 seconds and logs it.
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"HTTP post packet fl… Continue reading suricata http rule to identify POST requests
When someone tries to exploit a vulnerability either by sending traffic to the device directly or by making users click on malicious attachments, drive by exploits or other ways, is it possible you miss the initial attack vector even when … Continue reading Can you hide the initial exploit despite complete visibility into the network traffic?