Collaborate Disseminate
I’m thinking of using Suricata or Snort.
I can’t do anything myself, so I’m going to ask a freelance security engineer to do it.
If the engineer is skilled, once suricata or snort is set up, will it work fine in one setup?
at the moment,th… Continue reading What kind of engineers should I look for to implement Suricata or Snort?
I am trying to wrap my head around the difference between the different flow options in Snort.
There are four directional flow options:
Option Description
1) to_client Trigger on server responses from A to B
2) to_server Tri… Continue reading Difference between to_server and from_client in snort
I am trying to use snort to detect unauthorized HTTP access (wrong credentials or a HTTP status 401 code) by creating snort rules, I tried different combinations of snort options, but none of them fired an alert, here are the rules that I … Continue reading How to create a snort rule to detect a certain HTTP status code
What is the token generated when you create a snort rule that will detect all icmp traffic?
I’m in my last year of university and for my honour’s project I am tasked with comparing two intrusion detection systems, snort and suricata, hosted on a virtual machine on my PC.
As I have no access to networking devices such as switches … Continue reading What is the best way to create a PCAP file containing malicious traffic?
In our Suricata (version 6.0.4) logs we find many alerts messages like [1:2210045:2] SURICATA STREAM Packet with invalid ack [Classification: Generic Protocol Command Decode].
These come from the following rule:
alert tcp any any -> any… Continue reading How can I find out what rule option "stream-event:pkt_invalid_ack" means in Suricata? [closed]
How do you figure out Snort’s source & destination IP and port if the question is so vague? For example:
Write a snort rule that detects a UK NI number sent from a client’s web browser to a web server.
I understand how to write the reg… Continue reading How to determine Snort rules source & destination IP and port
I currently use fiddler/Charles Proxy/MITM proxy to decrypt and analyze SSL/TLS traffic from suspect mobile apps I want to analyze. The process I follow is to export a CA cert from Fiddler, then import that cert onto the physical phone. I … Continue reading Decrypt mobile phone app TLS/SSL traffic using Wireshark and Fiddler/Charles/MITM Proxy
How to configure Snort 3 to detect nmap’s port scanning? If port scanning is dectected I want to log it into a log file.
Continue reading How to configure Snort 3 to detect nmap’s port scanning? [duplicate]
How to configure snort 3 to detect nmap’s port scanning? For instance I want to know that an external machine A is looking with nmap for open ports on my machine B.
Such a port scan can include all ports incl. of the services available beh… Continue reading How to configure Snort 3 to detect nmap’s port scanning? [duplicate]