Collaborate Disseminate
I am reading some snort logs from a firewall, I could read some with “snort -r file”
But when I had tried the newest logs I get this error:
snort -r snort.log
Running in packet dump mode
–== Initializing Snort … Continue reading How can I read snort logs in NIDS mode?
I am reading some snort logs from a firewall, I could read some with “snort -r file”
But when I had tried the newest logs I get this error:
snort -r snort.log
Running in packet dump mode
–== Initializing Snort … Continue reading How can I read snort logs in NIDS mode?
How can we know exactly which packet alert triggered for?
Please let me know how I can find exact packet. I understand that IP addresses are an indication but there are mostly too many packets in pcaps for one IP.
Continue reading How to know for which packet snort alert triggered for
I am learning while configuring Snort, my setup consists in an attacker (Linux), a victim (Android smartphone) and one detection system (IDS). So far, I have been able to log all the packets between the attacker and victim in… Continue reading Snort rules to detect Meterpreter sessions
New to snort here. I downloaded snort (2.9.6.0 GRE Build 47) on my Ubuntu 14.04, also downloaded emergingthreat rules.
I ran the following command
root@myhp:~/pkgs/emergeThreats/snortRules# snort -vi tap0 -A fast -s -y -c… Continue reading Questions on snort generating too many events and not sending to syslog
New to snort here. I downloaded snort (2.9.6.0 GRE Build 47) on my Ubuntu 14.04, also downloaded emergingthreat rules.
I ran the following command
root@myhp:~/pkgs/emergeThreats/snortRules# snort -vi tap0 -A fast -s -y -c… Continue reading Questions on snort generating too many events and not sending to syslog
New to snort here. I downloaded snort (2.9.6.0 GRE Build 47) on my Ubuntu 14.04, also downloaded emergingthreat rules.
I ran the following command
root@myhp:~/pkgs/emergeThreats/snortRules# snort -vi tap0 -A fast -s -y -c… Continue reading Questions on snort generating too many events and not sending to syslog
I have Snort installed and tuned nicely with ET Rules on my pfSense,
both my pfSense and the modem are using Googles public DNS 8.8.8.8.
Recently I was denied access to google.com, and by reviewing the logs,
I found the following records … Continue reading Snort false positive, yet suspicious
I’ve set up a host-only network in Virtualbox consisting of a Kali linux machine and a Windows 7 machine (the host is running OS X). I have Snort installed on Windows 7 and am attempting to verify that it’s able to communicat… Continue reading Snort gives "could not create the registry key" error for multiple kinds of operations
alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:”Get2 method”; flow: to_server, established; dsize: >20; sid:1000006; priority: 15)
Snort does not generate any alert, whereas when I write the following rule: