[Snort-users] Snort-users Digest, Vol 96, Issue 62

Friska Ambarita friskaasnitha at ...11827...
Thu May 29 23:48:26 EDT 2014


Hello guys..
need ur help..
I've a research how to make snort as anti netcut ( or anti arpspoofing
attack)
i've looking for many script to configure snort but it didin't works.
anyone knows? or any idea what should i add to my snort  for make it as
anti netcut?
thankyou



2014-05-29 20:03 GMT+07:00 <snort-users-request at lists.sourceforge.net>:

> Send Snort-users mailing list submissions to
>         snort-users at lists.sourceforge.net
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://lists.sourceforge.net/lists/listinfo/snort-users
> or, via email, send a message with subject or body 'help' to
>         snort-users-request at lists.sourceforge.net
>
> You can reach the person managing the list at
>         snort-users-owner at lists.sourceforge.net
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Snort-users digest..."
>
>
> When responding, please don't respond with the entire Digest.  Please trim
> your response.
>
> Today's Topics:
>
>    1. Re: How to threshold ALL sigs (waldo kitty)
>    2. Re: How to threshold ALL sigs (waldo kitty)
>    3. Re: blacklist vs black_list :: pulledpork overwrites the
>       files with a list of IP addresses (waldo kitty)
>    4. Re: Snort spikes to 100% CPU followed by network  latency
>       (waldo kitty)
>    5. Re: How to threshold ALL sigs (Joel Esler (jesler))
>    6. Re: How to threshold ALL sigs (Russ Combs (rucombs))
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 28 May 2014 22:32:23 -0400
> From: waldo kitty <wkitty42 at ...14940...>
> Subject: Re: [Snort-users] How to threshold ALL sigs
> To: snort-users at lists.sourceforge.net
> Message-ID: <53869C37.6080108 at ...14940...>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> On 5/28/2014 2:49 PM, Turnbough, Bradley E. wrote:
>
> > After thresholding:
> >
> > sourceipA ------> destipA  ---- Alert A #1 10:29:15
> > sourceipA ------> destipA  ---- Alert A #2 10:29:26 ------ not logged
> (thresholded)
> > sourceipA ------> destipA  ---- Alert A #3 10:29:39 ------ not logged
> (thresholded)
> > sourceipB ------> destipA  ---- Alert A #4 10:29:42
> > sourceipB ------> destipA  ---- Alert A #5 10:29:55 ------ not logged
> (thresholded)
> > sourceipB ------> destipA  ---- Alert A #6 10:30:12------ not logged
> (thresholded)
> >
> > I want to basically write one rule / threshold for this.  I don't want
> to maintain a huge library of thresholds.  Any ideas?
>
> you can threshold in each rule... it isn't called threshold any more,
> though...
>
> eg: alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"LOCAL.RULES FTP
> Brute-Force login attempt (1) -- BLOCKED DESTINATION";
> flow:from_server,established; dsize:<100; content:"530 "; depth:4;
> pcre:"/^530\s+(Login|User|Failed|Not)/smi"; classtype:unsuccessful-user;
> detection_filter: track by_dst, count 5, seconds 300; sid:100000001;
> rev:5;)
>
> note the "detection_filter" section then follow up in the docs ;)
>
> --
>   NOTE: No off-list assistance is given without prior approval.
>         Please *keep mailing list traffic on the list* unless
>         private contact is specifically requested and granted.
>
>
>
> ------------------------------
>
> Message: 2
> Date: Wed, 28 May 2014 22:34:05 -0400
> From: waldo kitty <wkitty42 at ...14940...>
> Subject: Re: [Snort-users] How to threshold ALL sigs
> To: snort-users at lists.sourceforge.net
> Message-ID: <53869C9D.2040607 at ...14940...>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> On 5/28/2014 3:48 PM, Jefferson, Shawn wrote:
> > Yes, but that doesn't work for a SRC<->DEST type suppression.  You can
> only
> > make Snort blind to ALL things from that IP.  You need to use BPF to do a
> > SRC<->DEST suppression (basically not sending that traffic to snort at
> all.)
>
> no ya don't ;)  you've forgotten about "detection_filter" which is what
> the old
> in-rule thresholding is now called...
>
> eg: alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"LOCAL.RULES FTP
> Brute-Force login attempt (1) -- BLOCKED DESTINATION";
> flow:from_server,established; dsize:<100; content:"530 "; depth:4;
> pcre:"/^530\s+(Login|User|Failed|Not)/smi"; classtype:unsuccessful-user;
> detection_filter: track by_dst, count 5, seconds 300; sid:100000001;
> rev:5;)
>
> --
>   NOTE: No off-list assistance is given without prior approval.
>         Please *keep mailing list traffic on the list* unless
>         private contact is specifically requested and granted.
>
>
>
> ------------------------------
>
> Message: 3
> Date: Wed, 28 May 2014 22:37:23 -0400
> From: waldo kitty <wkitty42 at ...14940...>
> Subject: Re: [Snort-users] blacklist vs black_list :: pulledpork
>         overwrites the files with a list of IP addresses
> To: snort-users at lists.sourceforge.net
> Message-ID: <53869D63.4080206 at ...14940...>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> On 5/28/2014 4:47 PM, Steve Crow wrote:
> > Pulledpork is overwriting my blacklist.rules or black_list.rules files
> that
> > normally has rules in it with a list IP addresses. Whichever is listed in
> > snort.conf gets overwritten.
> >
> > Why are there two similarly named rules files.
> > What are their proper uses.
> > How does it need to be specified in snort.conf so that pulledpork doesn't
> > overwrite the rules with IP addresses?
>
> the one named in the reputation blacklist/whitelist section is the one that
> should have IP addresses in it... the other one is the one with rules in
> it...
>
> FWIW: this came up about a year+ ago... at that time, i suggested to VRt
> that
> they rename the reputation blacklist/whitelist files to RP_whitelist and
> RP_blacklist specifically so denote them being related to the reputation
> processor... i recommend you do the same now and leave the other one named
> as it
> is... i don't recall which is which but your snort.conf will tell you ;)
>
> --
>   NOTE: No off-list assistance is given without prior approval.
>         Please *keep mailing list traffic on the list* unless
>         private contact is specifically requested and granted.
>
>
>
> ------------------------------
>
> Message: 4
> Date: Wed, 28 May 2014 22:39:24 -0400
> From: waldo kitty <wkitty42 at ...14940...>
> Subject: Re: [Snort-users] Snort spikes to 100% CPU followed by
>         network latency
> To: snort-users at lists.sourceforge.net
> Message-ID: <53869DDC.2060802 at ...14940...>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> On 5/28/2014 5:40 PM, Cody Brugh wrote:
> > Also note that when we see these CPU/latency spikes we have no alerts or
> drops
> > that would easily tell us what is causing the problem. If it's not a
> rule what
> > should I start turning off to try eliminate possible causes?  It's
> something
> > that doesn't log or anything.
>
> what does your traffic look like on the line when this happens? is there
> any?
> are the light blinking? are you using some sort of additional packet
> capturing
> package that you can look at for the periods of high snort CPU usage???
>
> --
>   NOTE: No off-list assistance is given without prior approval.
>         Please *keep mailing list traffic on the list* unless
>         private contact is specifically requested and granted.
>
>
>
> ------------------------------
>
> Message: 5
> Date: Thu, 29 May 2014 12:44:41 +0000
> From: "Joel Esler (jesler)" <jesler at ...589...>
> Subject: Re: [Snort-users] How to threshold ALL sigs
> To: waldo kitty <wkitty42 at ...14940...>
> Cc: "snort-users at lists.sourceforge.net"
>         <snort-users at lists.sourceforge.net>
> Message-ID: <8C2B0696-3F0B-4615-BA8C-DDD338322D78 at ...589...>
> Content-Type: text/plain; charset="windows-1252"
>
> On May 28, 2014, at 10:34 PM, waldo kitty <wkitty42 at ...14940...<mailto:
> wkitty42 at ...14940...>> wrote:
>
> no ya don't ;)  you've forgotten about "detection_filter" which is what
> the old
> in-rule thresholding is now called...
>
> eg: alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"LOCAL.RULES FTP
> Brute-Force login attempt (1) -- BLOCKED DESTINATION";
> flow:from_server,established; dsize:<100; content:"530 "; depth:4;
> pcre:"/^530\s+(Login|User|Failed|Not)/smi"; classtype:unsuccessful-user;
> detection_filter: track by_dst, count 5, seconds 300; sid:100000001;
> rev:5;)
>
> kinda.  detection_filter doesn?t limit the number of alerts like threshold
> did.  That?s still threshold.
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
>
> ------------------------------
>
> Message: 6
> Date: Thu, 29 May 2014 13:03:20 +0000
> From: "Russ Combs (rucombs)" <rucombs at ...589...>
> Subject: Re: [Snort-users] How to threshold ALL sigs
> To: "Joel Esler (jesler)" <jesler at ...589...>, waldo kitty
>         <wkitty42 at ...14940...>
> Cc: "snort-users at lists.sourceforge.net"
>         <snort-users at lists.sourceforge.net>
> Message-ID:
>         <6BD6F06B9CA6764DB4E3B905660DEC5E08FE7B79 at ...16670...>
> Content-Type: text/plain; charset="windows-1252"
>
>
> ________________________________
> From: Joel Esler (jesler)
> Sent: Thursday, May 29, 2014 8:44 AM
> To: waldo kitty
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] How to threshold ALL sigs
>
> On May 28, 2014, at 10:34 PM, waldo kitty <wkitty42 at ...14940...<mailto:
> wkitty42 at ...14940...>> wrote:
>
> no ya don't ;)  you've forgotten about "detection_filter" which is what
> the old
> in-rule thresholding is now called...
>
> eg: alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"LOCAL.RULES FTP
> Brute-Force login attempt (1) -- BLOCKED DESTINATION";
> flow:from_server,established; dsize:<100; content:"530 "; depth:4;
> pcre:"/^530\s+(Login|User|Failed|Not)/smi"; classtype:unsuccessful-user;
> detection_filter: track by_dst, count 5, seconds 300; sid:100000001;
> rev:5;)
>
> kinda.  detection_filter doesn?t limit the number of alerts like threshold
> did.  That?s still threshold.
>
> * threshold is deprecated:
>
> -- use detection_filter in a rule to prevent it from generating events
> until the limit is reached
>
> -- use event_filter outside a rule to limit the number of events logged
>
> See README.filters for details.
>
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
>
> ------------------------------
>
>
> ------------------------------------------------------------------------------
> Time is money. Stop wasting it! Get your web API in 5 minutes.
> www.restlet.com/download
> http://p.sf.net/sfu/restlet
>
> ------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-users
>
>
> End of Snort-users Digest, Vol 96, Issue 62
> *******************************************
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20140530/514c9928/attachment.html>


More information about the Snort-users mailing list