Collaborate Disseminate
I want to obtain reassembled stream payload for both TCP and UDP in Suricata. How can i obtain stream data by manipulating the source code? Which methods/classes in the source can provide me the stream data?
I installed bina… Continue reading Suricata TCP/UDP reassembled stream
I have not found any examples on using the ‘bypass’ keyword.
Does it work in any rule? Are there performance implications using ‘bypass’.
For example, would this bypass all tcp traffic?
alert tcp any any <> any any (msg:"Allow a… Continue reading Suricata bypass keyword
What happens to a packet that has no matching rule in Suricata. I assume it is ignored, but haven’t found any definitive info on this.
So, if my assumption is correct and the packet is ignored, would it be better to capture … Continue reading Suricata not matching a packet
alert http any any ->; $EXTERNAL_NET any (
msg:"What do I alert on?";
content:"POST"; http_method;
content:"Content-Type|3a 20|application/json"; http_header; fast_patt… Continue reading How do I decode this Suricata code ? how to understand what it means? [on hold]
In snort I can easely get packet length attribute (pkt_len) related to an alert. However in Suricata I don’t see these information in JSON alerts (from eve.json). How can I get these information?
Continue reading How can I get Packet length from Suricata output?
Lets say malformed packets are sent by attacker with improper TCP options length i.e, 50bytes,222bytes etc.
Is there any way to monitor these packets having invalid tcp options set using Snort or Suricata ?
Do we have any… Continue reading Snort Rule to check for TCP options
What is the recommended size for Suricata ruleset(i.e., Signatures)?
Kindly answer with some references, reason.
Continue reading What is recommended size for Suricata Ruleset (i.e., Signatures)?
I try to find what is best to install,use and for protection for a List of Webservers and databases.
What you prefer Snort, bro or suricata ?
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i lo -l . -k none
7/9/2018 -… Continue reading Loopback with Suricata
I need to analyze an Apache log with Snort and others IDS/WAFs (Suricata, mod_security and Shadow Daemon). In order to do so, I was thinking about create TCP packets with the GET and POST requests stored in the Apache log wit… Continue reading Analyzing Apache log with Snort