Collaborate Disseminate
I am testing 3 IDS : Snort, Bro and Suricata with PF_RING packet capture framework.
In minimal setup, no rules and scripts are applied, fresh install in new machine, Suricata always show no packet are dropped or very small ra… Continue reading Why Snort and Bro drop so many packet while Suricata doesn’t?
I am in the preliminary stages of designing a cybersecurity suite for my home network. I don’t have any servers or anything, just the standard home setup (computers, tablets, game consoles). The bandwidth on my service plan is about 25-35M… Continue reading Can Snort run on a Raspberry Pi?
I am trying to setup a basic snort configuration to test first that snort is well working. After running snort, it seems that it was able to detect my one and only rule made for ICMP traffic, however I am getting this message… Continue reading Snort is not tracking ICMP traffic
I’m trying to use a device with 1GB of RAM and a Single 800 MHz core CPU.
I will use Snort to analyze traffic on my LAN network. Snort, unfortunately, cannot analyze all the traffic (sometimes it triggers an alert after a tri… Continue reading Can I run Snort on a slow computer?
I need snapshots of older Snort rules or rule changelog for research purposes. On official webpage I can find two last snapshots only!
Anybody can guide me?
I need snapshots of older Snort rules or rule changelog for research purposes. On official webpage I can find two last snapshots only!
Anybody can guide me?
My Snort alert output is like below. The first element of 4th row of each alert indicates Protocol. However, in the alert (portscan) TCP Portscan, the protocol is PROTO:255. What does it mean?
Why Portscan use PROTO:255 ins… Continue reading Snort Alert – What is PROTO:255?
I use Snort IDS on a dataset to generate alerts and export them to CSV output. Now, I want to display one more new field – Dangerous level of alerts.
Can Snort display the dangerous level of alerts? In README.csv file, I can… Continue reading Display dangerous level of Snort alert
I am experiencing trouble crating rules that would check user HTTP behaviour (page address, POST/GET params..).
alert tcp any any -> any any (msg:”Alfa in uri”; flow:to_server,established; uricontent:”/alfa.html”; nocase;… Continue reading Snort rules uricontent
I am experiencing trouble crating rules that would check user HTTP behaviour (page address, POST/GET params..).
alert tcp any any -> any any (msg:”Alfa in uri”; flow:to_server,established; uricontent:”/alfa.html”; nocase;… Continue reading Snort rules uricontent