[Snort-users] How to launch snort as an all time scanner network for a DHCP network scanner

Mark W. Jeanmougin markjx at gmail.com
Tue May 29 11:09:03 EDT 2018


Dorian,

At a client site, I deployed bro alongside snort to alert on malicious and
just plain "odd" dhcp traffic. It was a great way to detect rogue hosts on
the network, rogue dhcp servers, rogue wi-fi access points, things like
that.

I wouldn't call this "active scanning", it was certainly passive, but this
did turn out to be an incredibly effective, and inexpensive, part of their
security deployment.

MJ


On Tue, May 29, 2018 at 10:53 AM Joel Esler (jesler) via Snort-users <
snort-users at lists.snort.org> wrote:

> I am not exactly sure what you are asking for, but Snort is not an active
> scanner.
>
>
> --
> *Joel Esler*
> Sr. Manager
> Open Source, Design, Web, and Education
> Talos Group
> http://www.talosintelligence.com
>
> On May 25, 2018, at 3:53 PM, Dorian ROSSE <dorianbrice at hotmail.fr> wrote:
>
> Dear IT community,
>
>
> How to launch snort as an all time scanner network for a DHCP network scan
> mode against Virus, Trojan, bad UDP, bad listener, bad program....?(because
> this server is for Snort ans Nagios)
>
> Thank you in advance to answer my ask,
>
> Regards.
>
>
> Dorian Rosse.
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.snort.org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
> Please follow these rules:
> https://snort.org/faq/what-is-the-mailing-list-etiquette
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.snort.org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
> Please follow these rules:
> https://snort.org/faq/what-is-the-mailing-list-etiquette
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20180529/1a65da80/attachment.html>


More information about the Snort-users mailing list