Collaborate Disseminate
I’m trying to write a detector for Psiphon using its traffic signature, As its too time-consuming for finding traffic signature, Is there any tool that helps to extract traffic signature automatically?
Continue reading Is there any tool which automaticly findout traffic signature? [on hold]
I am using pulledpork for management of rules. I had enabled rules from 1:1000 to 1:5735 those rules are enabled but in the same time are skipped.
As output I had:
https://github.com/shirkdog/pulledpork
_____ ____… Continue reading snort rules are enabled by pulledpork but in the same time are skipped?
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
For instance, I have the following rul… Continue reading How can I get Suricata to alert on 1 packet every time
I am testing snort against pytbull. I am using pulledpork rules and snort 2.9.9.0. Tests do not detect LFI and all rule test. I have 31056 rules enabled (VRT (community, registered), ET) when I am searching for rules that wil… Continue reading Do registered snort rules contain all rules that match attack or do we need to add others?
can you show me snort rules to detect mitm attacks ??
Continue reading can you show me snort rules to detect mitm attacks [on hold]
I am running Snort as IDS in Security Onion and get this message: 0 Dynamic rules
All SO_RULES are loaded in snort.conf in the correct path.
25867 Snort rules read
23950 detection rules
150 decoder rules
268 p… Continue reading 0 dynamic rules read
I can’t find information about the frequency of signature updates for Snort. I mean the free version (not Sourcefire NGIPS). Does anybody know it?
Continue reading What is the frequency of signature updates for Snort (free version)? [on hold]
I am using snort 3 with all snort 3 community rules against pytbull ids. But snort does not detect attack, and also the signature was not matched. How can I perform snort 3 ++ rules for better detection of attack?
pytbull is… Continue reading How can I perform snort 3 signature?
What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both management and sniffing and… Continue reading Benefit of using two network interfaces for intrusion detection system
Is there any way to know that a session contains a certain signature in snort?
alert tcp any any -> any any (msg:”facebook”;pcre:”/facebook.com/i”;sid:10001;rev:1;)
The above code alerts when a packet contains ‘facebook… Continue reading Session labeling with snort