Ikenna Chiadikaobi | 28 Jun 16:12 2016
Picon

Error

hi, please i get this error.

WARNING: active responses disabled since DAQ can't inject packets.

 
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
James | 28 Jun 15:11 2016
Picon

pulledpork

Hello all,

I'm a bit stuck with setting up pulledpork for the first time, specifically disabling certain rules. I've read flowbits can cause this, but that's not present in the first one I've checked. My pulledpork.conf points to the correct location for disablesid.conf, which I've listed out a few like:

3:19187 # PROTOCOL-DNS TMG Firewall Client long host entry exploit attempt

When I re-run pulledpork.pl it says no rule changes are made and when I then restart Snort, I still see these rules firing.

While I'm here trying to solve that I may as well ask another question: Can I also use disablesid.conf to disable things like certain http_inspect and/or stream5 events, which don't appear to exist in the snort.rules file pulledpork uses?

Thanks for your wisdom.

James
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Kevin Wang | 27 Jun 23:59 2016

TCP stream processing performance

Hello,

 

I am looking at Snort performance and I found that in the Preprocessor profile statistics, “s5” or “s5tcp” is taking a lot of time. My understanding is that s5tcp is for TCP stream reassembly and the time taking is mostly due to the buffering and mis-ordered packets. The actually processing by the CPU is relatively short. Is my understanding correct or there is other intense processing going on?

 

Thanks,

Kevin

<!-- /* Font Definitions */ <at> font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} <at> font-face {font-family:??; panose-1:2 1 6 0 3 1 1 1 1 1;} <at> font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} <at> font-face {font-family:"\ <at> ??"; panose-1:2 1 6 0 3 1 1 1 1 1;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0cm; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} .MsoChpDefault {font-family:"Calibri",sans-serif;} .MsoPapDefault {margin-bottom:8.0pt; line-height:107%;} <at> page WordSection1 {size:612.0pt 792.0pt; margin:72.0pt 90.0pt 72.0pt 90.0pt;} div.WordSection1 {page:WordSection1;} -->

Email Disclaimer & Confidentiality Notice

This message is confidential and intended solely for the use of the recipient to whom they are addressed. If you are not the intended recipient you should not deliver, distribute or copy this e-mail. Please notify the sender immediately by e-mail and delete this e-mail from your system. Copyright © 2016 by Istuary Innovation Labs, Inc. All rights reserved. 

 

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Amir Goldman | 26 Jun 20:05 2016
Picon

Marking reassembled TCP segments

Hi,

Is there a way of marking tcp packets that are a part of one PDU?
When going over the unified 2 files, I want to have a way of knowing when to reassemble the packets to their original form ( like wireshark does).

Thanks

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Avery Rozar | 25 Jun 17:32 2016
Gravatar

u2 format differences from 2.9.8.0 to 2.9.8.2

I've run into some issues with Barnyard2 adding data into my database, even with appid disabled. Using hexdump to look at the snort.log file, it seems a bit diffrent in 2.9.8.2 vs 2.9.8.0. I'm curious if there was a change that is causing Barnyard2 to not fully read the u2 file like it used to.

I noticed an asterisk (*) between events now. Maybe its just how hexdump is reading the two diffrent u2 files I'm not sure...

I wrote a python script to parse u2 files back around Snort 2.9.7.6 and it is now missing all of the "events (Serial Unified2 Header # 104)" when parsing anything from 2.9.8.2. I can only assume that's also what Barnyard2 is missing. I'm only getting the "Serial Unified2 Header # 2" packets now.

Example:

Snort 2.9.8.0 hexdump (it's a continuous hexdump)

00000000  00 00 00 68 00 00 00 3c  00 00 00 00 00 00 00 01  |...h...<........|

00000010  56 df 51 72 00 08 8d 7e  00 00 3f ad 00 00 00 01  |V.Qr...~..?.....|

00000020  00 00 00 0e 00 00 00 09  00 00 00 01 42 3d aa 62  |............B=.b|

00000030  c0 a8 ac 20 00 50 11 91  06 20 00 01 00 00 00 00  |... .P... ......|

00000040  00 00 00 00 00 00 00 02  00 00 05 b6 00 00 00 00  |................|

00000050  00 00 00 01 56 df 51 72  56 df 51 72 00 08 8d 7e  |....V.QrV.Qr...~|

00000060  00 00 00 01 00 00 05 9a  f8 b1 56 3e d7 05 70 e4  |..........V>..p.|

00000070  22 85 6c f7 08 00 45 00  05 8c ac ac 40 00 39 06  |".l...E..... <at> .9.|

00000080  36 57 42 3d aa 62 c0 a8  ac 20 00 50 11 91 d4 0c  |6WB=.b... .P....|

00000090  1f 99 c7 f8 1c 4a 50 10  74 70 40 94 00 00 48 54  |.....JP.tp <at> ...HT|

000000a0  54 50 2f 31 2e 31 20 32  30 30 20 4f 4b 0d 0a 53  |TP/1.1 200 OK..S|

000000b0  65 72 76 65 72 3a 20 6e  67 69 6e 78 2f 31 2e 36  |erver: nginx/1.6|

000000c0  2e 32 0d 0a 43 6f 6e 74  65 6e 74 2d 54 79 70 65  |.2..Content-Type|

000000d0  3a 20 61 70 70 6c 69 63  61 74 69 6f 6e 2f 78 2d  |: application/x-|

000000e0  6a 61 76 61 73 63 72 69  70 74 0d 0a 45 78 70 69  |javascript..Expi|

000000f0  72 65 73 3a 20 57 65 64  2c 20 30 39 20 4d 61 72  |res: Wed, 09 Mar|

00000100  20 32 30 31 36 20 32 33  3a 35 34 3a 34 39 20 47  | 2016 23:54:49 G|

00000110  4d 54 0d 0a 43 61 63 68  65 2d 43 6f 6e 74 72 6f  |MT..Cache-Contro|

00000120  6c 3a 20 6d 61 78 2d 61  67 65 3d 38 36 34 30 30  |l: max-age=86400|

00000130  0d 0a 43 6f 6e 74 65 6e  74 2d 45 6e 63 6f 64 69  |..Content-Encodi|

00000140  6e 67 3a 20 67 7a 69 70  0d 0a 43 6f 6e 74 65 6e  |ng: gzip..Conten|

00000150  74 2d 4c 65 6e 67 74 68  3a 20 33 34 31 30 33 0d  |t-Length: 34103.|

00000160  0a 44 61 74 65 3a 20 57  65 64 2c 20 30 39 20 4d  |.Date: Wed, 09 M|

00000170  61 72 20 32 30 31 36 20  30 30 3a 32 37 3a 33 34  |ar 2016 00:27:34|

00000180  20 47 4d 54 0d 0a 43 6f  6e 6e 65 63 74 69 6f 6e  | GMT..Connection|

00000190  3a 20 6b 65 65 70 2d 61  6c 69 76 65 0d 0a 56 61  |: keep-alive..Va|

000001a0  72 79 3a 20 41 63 63 65  70 74 2d 45 6e 63 6f 64  |ry: Accept-Encod|

000001b0  69 6e 67 0d 0a 0d 0a 1f  8b 08 00 00 00 00 00 00  |ing.............| 


Snort 2.9.8.2 (It has the "*" in the file)

00000000  00 00 00 6f 00 00 00 7c  00 00 00 00 00 00 00 01  |...o...|........|

00000010  57 6e 99 a4 00 0d 69 33  00 0f 42 42 00 00 00 01  |Wn....i3..BB....|

00000020  00 00 00 01 00 00 00 1c  00 00 00 01 ac 1f fe 98  |................|

00000030  ac 1f fb 0a ee 0a 00 50  06 20 00 01 00 00 00 00  |.......P. ......|

00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

00000080  00 00 00 00 00 00 00 02  00 00 02 f5 00 00 00 00  |................|

00000090  00 00 00 01 57 6e 99 a4  57 6e 99 a4 00 0d 69 33  |....Wn..Wn....i3|

000000a0  00 00 00 01 00 00 02 d9  00 50 56 bc 8f 72 d0 d0  |.........PV..r..|

000000b0  fd 27 4e 47 08 00 45 00  02 cb 72 15 40 00 3f 06  |.'NG..E...r. <at> .?.|

000000c0  75 35 ac 1f fe 98 ac 1f  fb 0a ee 0a 00 50 18 1c  |u5...........P..|

000000d0  c0 ec 3e 91 d2 23 80 18  10 15 28 3c 00 00 01 01  |..>..#....(<....|

000000e0  08 0a 39 f5 dd 29 71 48  16 ad 47 45 54 20 2f 77  |..9..)qH..GET /w|

000000f0  70 2d 61 64 6d 69 6e 2f  20 48 54 54 50 2f 31 2e  |p-admin/ HTTP/1.|

00000100  31 0d 0a 48 6f 73 74 3a  20 77 77 77 2e 69 6e 73  |1..Host: www.ins|

00000110  65 63 75 72 65 2d 69 74  2e 63 6f 6d 0d 0a 43 6f  |ecure-it.com..Co|

00000120  6e 6e 65 63 74 69 6f 6e  3a 20 6b 65 65 70 2d 61  |nnection: keep-a|

00000130  6c 69 76 65 0d 0a 55 70  67 72 61 64 65 2d 49 6e  |live..Upgrade-In|

00000140  73 65 63 75 72 65 2d 52  65 71 75 65 73 74 73 3a  |secure-Requests:|

00000150  20 31 0d 0a 55 73 65 72  2d 41 67 65 6e 74 3a 20  | 1..User-Agent: |

00000160  4d 6f 7a 69 6c 6c 61 2f  35 2e 30 20 28 4d 61 63  |Mozilla/5.0 (Mac|

00000170  69 6e 74 6f 73 68 3b 20  49 6e 74 65 6c 20 4d 61  |intosh; Intel Ma|

00000180  63 20 4f 53 20 58 20 31  30 5f 31 31 5f 35 29 20  |c OS X 10_11_5) |

00000190  41 70 70 6c 65 57 65 62  4b 69 74 2f 35 33 37 2e  |AppleWebKit/537.|

000001a0  33 36 20 28 4b 48 54 4d  4c 2c 20 6c 69 6b 65 20  |36 (KHTML, like |

000001b0  47 65 63 6b 6f 29 20 43  68 72 6f 6d 65 2f 35 31  |Gecko) Chrome/51|

000001c0  2e 30 2e 32 37 30 34 2e  31 30 33 20 53 61 66 61  |.0.2704.103 Safa|

000001d0  72 69 2f 35 33 37 2e 33  36 0d 0a 41 63 63 65 70  |ri/537.36..Accep|

000001e0  74 3a 20 74 65 78 74 2f  68 74 6d 6c 2c 61 70 70  |t: text/html,app|

000001f0  6c 69 63 61 74 69 6f 6e  2f 78 68 74 6d 6c 2b 78  |lication/xhtml+x|

00000200  6d 6c 2c 61 70 70 6c 69  63 61 74 69 6f 6e 2f 78  |ml,application/x|

00000210  6d 6c 3b 71 3d 30 2e 39  2c 69 6d 61 67 65 2f 77  |ml;q=0.9,image/w|

00000220  65 62 70 2c 2a 2f 2a 3b  71 3d 30 2e 38 0d 0a 41  |ebp,*/*;q=0.8..A|

00000230  63 63 65 70 74 2d 45 6e  63 6f 64 69 6e 67 3a 20  |ccept-Encoding: |

00000240  67 7a 69 70 2c 20 64 65  66 6c 61 74 65 2c 20 73  |gzip, deflate, s|

00000250  64 63 68 0d 0a 41 63 63  65 70 74 2d 4c 61 6e 67  |dch..Accept-Lang|

00000260  75 61 67 65 3a 20 65 6e  2d 55 53 2c 65 6e 3b 71  |uage: en-US,en;q|

00000270  3d 30 2e 38 0d 0a 43 6f  6f 6b 69 65 3a 20 50 48  |=0.8..Cookie: PH|

00000280  50 53 45 53 53 49 44 3d  39 71 6e 67 62 76 74 6d  |PSESSID=9qngbvtm|

00000290  32 71 6f 33 61 30 64 66  63 64 72 72 70 63 32 76  |2qo3a0dfcdrrpc2v|

000002a0  72 34 3b 20 77 6f 72 64  70 72 65 73 73 5f 74 65  |r4; wordpress_te|

000002b0  73 74 5f 63 6f 6f 6b 69  65 3d 57 50 2b 43 6f 6f  |st_cookie=WP+Coo|

000002c0  6b 69 65 2b 63 68 65 63  6b 3b 20 4e 43 53 5f 49  |kie+check; NCS_I|

000002d0  4e 45 4e 54 49 4d 3d 31  34 36 36 38 36 32 39 31  |NENTIM=146686291|

000002e0  31 3b 20 4a 43 53 5f 49  4e 45 4e 54 49 4d 3d 31  |1; JCS_INENTIM=1|

000002f0  34 36 36 38 36 32 37 30  34 37 30 36 3b 20 33 38  |466862704706; 38|

00000300  39 61 65 32 31 30 30 34  30 61 62 37 35 30 63 31  |9ae210040ab750c1|

00000310  35 62 33 65 62 32 33 61  62 36 65 34 37 38 3d 39  |5b3eb23ab6e478=9|

00000320  30 30 37 61 65 61 35 36  66 61 61 34 34 61 66 32  |007aea56faa44af2|

00000330  62 38 61 61 33 37 33 64  66 65 33 31 62 37 66 3b  |b8aa373dfe31b7f;|

00000340  20 53 4a 45 43 54 31 35  3d 43 4b 4f 4e 31 35 3b  | SJECT15=CKON15;|

00000350  20 5f 67 61 3d 47 41 31  2e 32 2e 36 31 34 34 31  | _ga=GA1.2.61441|

00000360  34 36 32 32 2e 31 34 36  30 30 37 33 33 33 34 3b  |4622.1460073334;|

00000370  20 4a 43 53 5f 49 4e 45  4e 52 45 46 3d 0d 0a 0d  | JCS_INENREF=...|

00000380  0a 00 00 00 6f 00 00 00  7c 00 00 00 00 00 00 00  |....o...|.......|

00000390  02 57 6e 99 a4 00 0d 6f  42 00 0f 42 42 00 00 00  |.Wn....oB..BB...|

000003a0  01 00 00 00 01 00 00 00  1c 00 00 00 01 ac 1f fe  |................|

000003b0  98 ac 1f fb 0a ee 0b 00  50 06 20 00 01 00 00 00  |........P. .....|

000003c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

Thanks,

Avery

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Andrey Kiryukhin | 24 Jun 17:06 2016
Picon

why UDP disc acquire?

Hi all. I use snort 2.9.8.2 A have some pcap file for old attack (see attach) .  It contain only udp packets.
I wrote test rule: 

alert udp any 500 -> any 500 (msg:"DOS Nbisakmp"; classtype: attempted-dos; sid:1000001; rev:1;)

and run snort:

snort  -c ./etc/snort.conf -A console -K none  -k none  -r ./pcaps/DOS_Nbisakmp.pcap

and get no alerts. In output stats i have: 

...........
Packet I/O Totals:
   Received:          100
   Analyzed:          100 (100.000%)
    Dropped:            0 (  0.000%)
   Filtered:            0 (  0.000%)
Outstanding:            0 (  0.000%)
   Injected:            0
.....................

Breakdown by protocol (includes rebuilt packets):
        Eth:          100 (100.000%)
       VLAN:            0 (  0.000%)
        IP4:          100 (100.000%)
       Frag:            0 (  0.000%)
       ICMP:            0 (  0.000%)
        UDP:          100 (100.000%)
...................
 UDP Disc:          100 (100.000%)
  ICMP Disc:            0 (  0.000%)
All Discard:          100 (100.000%)

(full output and snort.conf see in attach)


If i change rule  (udp to ip)  :

alert ip any 500 -> any 500 (msg:"DOS Nbisakmp"; classtype: attempted-dos; sid:1000001; rev:1;)
all packets generate alerts. 


So, why UDP packets in sample pcap discarded if i use udp protocol in alert?
Attachment (DOS_Nbisakmp.pcap): application/vnd.tcpdump.pcap, 113 KiB
Attachment (out.log): text/x-log, 23 KiB
#--------------------------------------------------
#   VRT Rule Packages Snort.conf
#
#   For more information visit us at:
#     http://www.snort.org                   Snort Website
#     http://vrt-sourcefire.blogspot.com/    Sourcefire VRT Blog
#
#     Mailing list Contact:      snort-sigs <at> lists.sourceforge.net
#     False Positive reports:    fp <at> sourcefire.com
#     Snort bugs:                bugs <at> snort.org
#
#     Compatible with Snort Versions:
#     VERSIONS : 2.9.3.1
#
#     Snort build options:
#     OPTIONS : --enable-ipv6 --enable-gre --enable-mpls --enable-targetbased
--enable-decoder-preprocessor-rules --enable-ppm --enable-perfprofiling --enable-zlib
--enable-active-response --enable-normalizer --enable-reload --enable-react --enable-flexresp3
#
#     Additional information:
#     This configuration file enables active response, to run snort in
#     test mode -T you are required to supply an interface -i <interface>
#     or test mode will fail to fully validate the configuration and
#     exit with a FATAL error
#--------------------------------------------------

###################################################
# This file contains a sample snort configuration. 
# You should take the following steps to create your own custom configuration:
#
#  1) Set the network variables.
#  2) Configure the decoder
#  3) Configure the base detection engine
#  4) Configure dynamic loaded libraries
#  5) Configure preprocessors
#  6) Configure output plugins
#  7) Customize your rule set
#  8) Customize preprocessor and decoder rule set
#  9) Customize shared object rule set
###################################################

###################################################
# Step #1: Set the network variables.  For more information, see README.variables
###################################################

# Setup the network addresses you are protecting
ipvar HOME_NET any
#ipvar HOME_NET [1.1.1.1/24]

# Set up the external network addresses. Leave as "any" in most situations
ipvar EXTERNAL_NET any

# List of DNS servers on your network 
#ipvar DNS_SERVERS $HOME_NET
ipvar DNS_SERVERS 1.1.1.1/32

# List of SMTP servers on your network
#ipvar SMTP_SERVERS $HOME_NET
ipvar SMTP_SERVERS 1.1.1.1/32

# List of web servers on your network
ipvar HTTP_SERVERS $HOME_NET

# List of sql servers on your network 
ipvar SQL_SERVERS $HOME_NET

# List of telnet servers on your network
ipvar TELNET_SERVERS $HOME_NET

# List of ssh servers on your network
ipvar SSH_SERVERS $HOME_NET

# List of ftp servers on your network
ipvar FTP_SERVERS $HOME_NET

# List of sip servers on your network
ipvar SIP_SERVERS $HOME_NET

# List of ports you run web servers on
portvar HTTP_PORTS [80,81,311,383,591,593,901,1220,1414,1741,1830,2301,2381,2809,3128,3702,4343,4848,5250,7001,7145,7510,7777,7779,8000,8008,8014,8028,8080,8088,8090,8118,8123,8180,8181,8243,8280,8300,8800,8888,8899,9000,9060,9080,9090,9091,9443,9999,11371,50002,55555]

# List of ports you want to look for SHELLCODE on.
portvar SHELLCODE_PORTS !80

# List of ports you might see oracle attacks on
portvar ORACLE_PORTS 1024:

# List of ports you want to look for SSH connections on:
portvar SSH_PORTS 22

# List of ports you run ftp servers on
portvar FTP_PORTS [21,2100,3535]

# List of ports you run SIP servers on
portvar SIP_PORTS [5060,5061,5600]

# List of file data ports for file inspection
portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143]

# List of GTP ports for GTP preprocessor
portvar GTP_PORTS [2123,2152,3386]

# other variables, these should not be modified
ipvar AIM_SERVERS [64.12.24.0/23,64.12.28.0/23,64.12.161.0/24,64.12.163.0/24,64.12.200.0/24,205.188.3.0/24,205.188.5.0/24,205.188.7.0/24,205.188.9.0/24,205.188.153.0/24,205.188.179.0/24,205.188.248.0/24]

# Path to your rules files (this can be a relative path)
# Note for Windows users:  You are advised to make this an absolute path,
# such as:  c:\snort\rules
var RULE_PATH ../rules
var SO_RULE_PATH ../so_rules
var PREPROC_RULE_PATH ../preproc_rules

# If you are using reputation preprocessor set these
# Currently there is a bug with relative paths, they are relative to where snort is
# not relative to snort.conf like the above variables
# This is completely inconsistent with how other vars work, BUG 89986
# Set the absolute path appropriately
var WHITE_LIST_PATH ../rules
var BLACK_LIST_PATH ../rules

###################################################
# Step #2: Configure the decoder.  For more information, see README.decode
###################################################

# Stop generic decode events:
config disable_decode_alerts

# Stop Alerts on experimental TCP options
config disable_tcpopt_experimental_alerts

# Stop Alerts on obsolete TCP options
config disable_tcpopt_obsolete_alerts

# Stop Alerts on T/TCP alerts
config disable_tcpopt_ttcp_alerts

# Stop Alerts on all other TCPOption type events:
config disable_tcpopt_alerts

# Stop Alerts on invalid ip options
config disable_ipopt_alerts

# Alert if value in length field (IP, TCP, UDP) is greater th elength of the packet
# config enable_decode_oversized_alerts

# Same as above, but drop packet if in Inline mode (requires enable_decode_oversized_alerts)
# config enable_decode_oversized_drops

# Configure IP / TCP checksum mode
config checksum_mode: all

# Configure maximum number of flowbit references.  For more information, see README.flowbits
# config flowbits_size: 64

# Configure ports to ignore 
# config ignore_ports: tcp 21 6667:6671 1356
# config ignore_ports: udp 1:17 53

# Configure active response for non inline operation. For more information, see REAMDE.active
# config response: eth0 attempts 2

# Configure DAQ related options for inline operation. For more information, see README.daq
#
# config daq: <type>
# config daq_dir: <dir>
# config daq_mode: <mode>
# config daq_var: <var>
#
# <type> ::= pcap | afpacket | dump | nfq | ipq | ipfw
# <mode> ::= read-file | passive | inline
# <var> ::= arbitrary <name>=<value passed to DAQ
# <dir> ::= path as to where to look for DAQ module so's

# Configure specific UID and GID to run snort as after dropping privs. For more information see snort -h
command line options
#
# config set_gid:
# config set_uid:

# Configure default snaplen. Snort defaults to MTU of in use interface. For more information see README
#
# config snaplen:
#

# Configure default bpf_file to use for filtering what traffic reaches snort. For more information see
snort -h command line options (-F)
#
# config bpf_file:
#

# Configure default log directory for snort to log to.  For more information see snort -h command line
options (-l)
#
# config logdir:

###################################################
# Step #3: Configure the base detection engine.  For more information, see  README.decode
###################################################

# Configure PCRE match limitations
config pcre_match_limit: 3500
config pcre_match_limit_recursion: 1500

# Configure the detection engine  See the Snort Manual, Configuring Snort - Includes - Config
config detection: search-method ac-split search-optimize max-pattern-len 20

# Configure the event queue.  For more information, see README.event_queue
config event_queue: max_queue 8 log 5 order_events content_length

###################################################
## Configure GTP if it is to be used.
## For more information, see README.GTP
####################################################

# config enable_gtp

###################################################
# Per packet and rule latency enforcement
# For more information see README.ppm
###################################################

# Per Packet latency configuration
#config ppm: max-pkt-time 250, \
#   fastpath-expensive-packets, \
#   pkt-log

# Per Rule latency configuration
#config ppm: max-rule-time 200, \
#   threshold 3, \
#   suspend-expensive-rules, \
#   suspend-timeout 20, \
#   rule-log alert

###################################################
# Configure Perf Profiling for debugging
# For more information see README.PerfProfiling
###################################################

#config profile_rules: print all, sort avg_ticks
#config profile_preprocs: print all, sort avg_ticks

###################################################
# Configure protocol aware flushing
# For more information see README.stream5
###################################################
config paf_max: 16000

###################################################
# Step #4: Configure dynamic loaded libraries.  
# For more information, see Snort Manual, Configuring Snort - Dynamic Modules
###################################################

# path to dynamic preprocessor libraries
dynamicpreprocessor directory  /home/cham/Work/Tester/IDS_and_other/snort/snort_current/snort_build/libs/lib/snort_dynamicpreprocessor/

# path to base preprocessor engine
dynamicengine /home/cham/Work/Tester/IDS_and_other/snort/snort_current/snort_build/libs/lib/snort_dynamicengine/libsf_engine.so

# path to dynamic rules libraries
#dynamicdetection directory /home/cham/Work/Tester/IDS_and_other/snort/snort_current/snort_build/libs/lib/snort_dynamicrules

###################################################
# Step #5: Configure preprocessors
# For more information, see the Snort Manual, Configuring Snort - Preprocessors
###################################################

# GTP Control Channle Preprocessor. For more information, see README.GTP
# preprocessor gtp: ports { 2123 3386 2152 }

# Inline packet normalization. For more information, see README.normalize
# Does nothing in IDS mode
preprocessor normalize_ip4
preprocessor normalize_tcp: ips ecn stream
preprocessor normalize_icmp4
preprocessor normalize_ip6
preprocessor normalize_icmp6

# Target-based IP defragmentation.  For more inforation, see README.frag3
preprocessor frag3_global: max_frags 65536
preprocessor frag3_engine: policy windows detect_anomalies overlap_limit 10 min_fragment_length
100 timeout 180

# Target-Based stateful inspection/stream reassembly.  For more inforation, see README.stream5
preprocessor stream5_global: track_tcp yes, \
   track_udp yes, \
   track_icmp no, \ 
   max_tcp 262144, \
   max_udp 131072, \
   max_active_responses 2, \
   min_response_seconds 5
preprocessor stream5_tcp: policy windows, detect_anomalies, require_3whs 180, \
   overlap_limit 10, small_segments 3 bytes 150, timeout 180, \
    ports client 21 22 23 25 42 53 79 109 110 111 113 119 135 136 137 139 143 \
        161 445 513 514 587 593 691 1433 1521 1741 2100 3306 6070 6665 6666 6667 6668 6669 \
        7000 8181 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779, \
    ports both 80 81 311 383 443 465 563 591 593 636 901 989 992 993 994 995 1220 1414 1830 2301 2381 2809 3128 3702
4343 4848 5250 7907 7001 7145 7510 7802 7777 7779 \
        7801 7900 7901 7902 7903 7904 7905 7906 7908 7909 7910 7911 7912 7913 7914 7915 7916 \
        7917 7918 7919 7920 8000 8008 8014 8028 8080 8088 8090 8118 8123 8180 8243 8280 8300 8800 8888 8899 9000 9060
9080 9090 9091 9443 9999 11371 50002 55555
preprocessor stream5_udp: timeout 180

# performance statistics.  For more information, see the Snort Manual, Configuring Snort - Preprocessors
- Performance Monitor
# preprocessor perfmonitor: time 300 file /var/snort/snort.stats pktcnt 10000

# HTTP normalization and anomaly detection.  For more information, see README.http_inspect
preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 65535
decompress_depth 65535
preprocessor http_inspect_server: server default \
    http_methods { GET POST PUT SEARCH MKCOL COPY MOVE LOCK UNLOCK NOTIFY POLL BCOPY BDELETE BMOVE LINK UNLINK
OPTIONS HEAD DELETE TRACE TRACK CONNECT SOURCE SUBSCRIBE UNSUBSCRIBE PROPFIND PROPPATCH BPROPFIND
BPROPPATCH RPC_CONNECT PROXY_SUCCESS BITS_POST CCM_POST SMS_POST RPC_IN_DATA RPC_OUT_DATA
RPC_ECHO_DATA } \
    chunk_length 500000 \
    server_flow_depth 0 \
    client_flow_depth 0 \
    post_depth 65495 \
    oversize_dir_length 500 \
    max_header_length 750 \
    max_headers 100 \
    max_spaces 200 \
    small_chunk_length { 10 5 } \
    ports { 80 81 311 383 591 593 901 1220 1414 1741 1830 2301 2381 2809 3128 3702 4343 4848 5250 7001 7145 7510 7777
7779 8000 8008 8014 8028 8080 8088 8090 8118 8123 8180 8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090
9091 9443 9999 11371 50002 55555 } \
    non_rfc_char { 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 } \
    enable_cookie \
    extended_response_inspection \
    inspect_gzip \
    normalize_utf \
    unlimited_decompress \
    normalize_javascript \
    apache_whitespace no \
    ascii no \
    bare_byte no \
    directory no \
    double_decode no \
    iis_backslash no \
    iis_delimiter no \
    iis_unicode no \
    multi_slash no \
    utf_8 no \
    u_encode yes \
    webroot no

# ONC-RPC normalization and anomaly detection.  For more information, see the Snort Manual, Configuring
Snort - Preprocessors - RPC Decode
preprocessor rpc_decode: 111 32770 32771 32772 32773 32774 32775 32776 32777 32778 32779
no_alert_multiple_requests no_alert_large_fragments no_alert_incomplete

# Back Orifice detection.
preprocessor bo

# FTP / Telnet normalization and anomaly detection.  For more information, see README.ftptelnet
preprocessor ftp_telnet: global inspection_type stateful encrypted_traffic no check_encrypted
preprocessor ftp_telnet_protocol: telnet \
    ayt_attack_thresh 20 \
    normalize ports { 23 } \
    detect_anomalies
preprocessor ftp_telnet_protocol: ftp server default \
    def_max_param_len 100 \
    ports { 21 2100 3535 } \
    telnet_cmds yes \
    ignore_telnet_erase_cmds yes \
    ftp_cmds { ABOR ACCT ADAT ALLO APPE AUTH CCC CDUP } \
    ftp_cmds { CEL CLNT CMD CONF CWD DELE ENC EPRT } \
    ftp_cmds { EPSV ESTA ESTP FEAT HELP LANG LIST LPRT } \
    ftp_cmds { LPSV MACB MAIL MDTM MIC MKD MLSD MLST } \
    ftp_cmds { MODE NLST NOOP OPTS PASS PASV PBSZ PORT } \
    ftp_cmds { PROT PWD QUIT REIN REST RETR RMD RNFR } \
    ftp_cmds { RNTO SDUP SITE SIZE SMNT STAT STOR STOU } \
    ftp_cmds { STRU SYST TEST TYPE USER XCUP XCRC XCWD } \
    ftp_cmds { XMAS XMD5 XMKD XPWD XRCP XRMD XRSQ XSEM } \
    ftp_cmds { XSEN XSHA1 XSHA256 } \
    alt_max_param_len 0 { ABOR CCC CDUP ESTA FEAT LPSV NOOP PASV PWD QUIT REIN STOU SYST XCUP XPWD } \
    alt_max_param_len 200 { ALLO APPE CMD HELP NLST RETR RNFR STOR STOU XMKD } \
    alt_max_param_len 256 { CWD RNTO } \
    alt_max_param_len 400 { PORT } \
    alt_max_param_len 512 { SIZE } \
    chk_str_fmt { ACCT ADAT ALLO APPE AUTH CEL CLNT CMD } \
    chk_str_fmt { CONF CWD DELE ENC EPRT EPSV ESTP HELP } \
    chk_str_fmt { LANG LIST LPRT MACB MAIL MDTM MIC MKD } \
    chk_str_fmt { MLSD MLST MODE NLST OPTS PASS PBSZ PORT } \
    chk_str_fmt { PROT REST RETR RMD RNFR RNTO SDUP SITE } \
    chk_str_fmt { SIZE SMNT STAT STOR STRU TEST TYPE USER } \
    chk_str_fmt { XCRC XCWD XMAS XMD5 XMKD XRCP XRMD XRSQ } \ 
    chk_str_fmt { XSEM XSEN XSHA1 XSHA256 } \
    cmd_validity ALLO < int [ char R int ] > \    
    cmd_validity EPSV < [ { char 12 | char A char L char L } ] > \
    cmd_validity MACB < string > \
    cmd_validity MDTM < [ date nnnnnnnnnnnnnn[.n[n[n]]] ] string > \
    cmd_validity MODE < char ASBCZ > \
    cmd_validity PORT < host_port > \
    cmd_validity PROT < char CSEP > \
    cmd_validity STRU < char FRPO [ string ] > \    
    cmd_validity TYPE < { char AE [ char NTC ] | char I | char L [ number ] } >
preprocessor ftp_telnet_protocol: ftp client default \
    max_resp_len 256 \
    bounce yes \
    ignore_telnet_erase_cmds yes \
    telnet_cmds yes

# SMTP normalization and anomaly detection.  For more information, see README.SMTP
preprocessor smtp: ports { 25 465 587 691 } \
    inspection_type stateful \
    b64_decode_depth 0 \
    qp_decode_depth 0 \
    bitenc_decode_depth 0 \
    uu_decode_depth 0 \
    log_mailfrom \
    log_rcptto \
    log_filename \
    log_email_hdrs \
    normalize cmds \
    normalize_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY } \
    normalize_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SOML } \
    normalize_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT X-DRCP X-ERCP X-EXCH50 } \
    normalize_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \
    max_command_line_len 512 \
    max_header_line_len 1000 \
    max_response_line_len 512 \
    alt_max_command_line_len 260 { MAIL } \
    alt_max_command_line_len 300 { RCPT } \
    alt_max_command_line_len 500 { HELP HELO ETRN EHLO } \
    alt_max_command_line_len 255 { EXPN VRFY ATRN SIZE BDAT DEBUG EMAL ESAM ESND ESOM EVFY IDENT NOOP RSET } \
    alt_max_command_line_len 246 { SEND SAML SOML AUTH TURN ETRN DATA RSET QUIT ONEX QUEU STARTTLS TICK TIME
TURNME VERB X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \
    valid_cmds { ATRN AUTH BDAT CHUNKING DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN EVFY } \ 
    valid_cmds { EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND SOML } \
    valid_cmds { STARTTLS TICK TIME TURN TURNME VERB VRFY X-ADAT X-DRCP X-ERCP X-EXCH50 } \
    valid_cmds { X-EXPS X-LINK2STATE XADR XAUTH XCIR XEXCH50 XGEN XLICENSE XQUE XSTA XTRN XUSR } \
    xlink2state { enabled }

# Portscan detection.  For more information, see README.sfportscan
# preprocessor sfportscan: proto  { all } memcap { 10000000 } sense_level { low }

# ARP spoof detection.  For more information, see the Snort Manual - Configuring Snort - Preprocessors - ARP
Spoof Preprocessor
# preprocessor arpspoof
# preprocessor arpspoof_detect_host: 192.168.40.1 f0:0f:00:f0:0f:00

# SSH anomaly detection.  For more information, see README.ssh
preprocessor ssh: server_ports { 22 } \
                  autodetect \
                  max_client_bytes 19600 \
                  max_encrypted_packets 20 \
                  max_server_version_len 100 \
                  enable_respoverflow enable_ssh1crc32 \
                  enable_srvoverflow enable_protomismatch

# SMB / DCE-RPC normalization and anomaly detection.  For more information, see README.dcerpc2
preprocessor dcerpc2: memcap 102400, events [co ]
preprocessor dcerpc2_server: default, policy WinXP, \
    detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \
    autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:], \
    smb_max_chain 3, smb_invalid_shares ["C$", "D$", "ADMIN$"]

# DNS anomaly detection.  For more information, see README.dns
preprocessor dns: ports { 53 } enable_rdata_overflow

# SSL anomaly detection and traffic bypass.  For more information, see README.ssl
preprocessor ssl: ports { 443 465 563 636 989 992 993 994 995 7801 7802 7900 7901 7902 7903 7904 7905 7906 7907
7908 7909 7910 7911 7912 7913 7914 7915 7916 7917 7918 7919 7920 }, trustservers, noinspect_encrypted

# SDF sensitive data preprocessor.  For more information see README.sensitive_data
preprocessor sensitive_data: alert_threshold 25

# SIP Session Initiation Protocol preprocessor.  For more information see README.sip
preprocessor sip: max_sessions 40000, \
   ports { 5060 5061 5600 }, \
   methods { invite \
             cancel \
             ack \
             bye \
             register \
             options \
             refer \
             subscribe \
             update \
             join \
             info \
             message \
             notify \
             benotify \
             do \
             qauth \
             sprack \
             publish \
             service \
             unsubscribe \
             prack }, \
   max_uri_len 512, \
   max_call_id_len 80, \
   max_requestName_len 20, \
   max_from_len 256, \
   max_to_len 256, \
   max_via_len 1024, \
   max_contact_len 512, \
   max_content_len 2048 

# IMAP preprocessor.  For more information see README.imap
preprocessor imap: \
   ports { 143 } \
   b64_decode_depth 0 \
   qp_decode_depth 0 \
   bitenc_decode_depth 0 \
   uu_decode_depth 0

# POP preprocessor. For more information see README.pop
preprocessor pop: \
   ports { 110 } \
   b64_decode_depth 0 \
   qp_decode_depth 0 \
   bitenc_decode_depth 0 \
   uu_decode_depth 0

# Modbus preprocessor. For more information see README.modbus
preprocessor modbus: ports { 502 }

# DNP3 preprocessor. For more information see README.dnp3
preprocessor dnp3: ports { 20000 } \
   memcap 262144 \
   check_crc

# Reputation preprocessor. For more information see README.reputation
#preprocessor reputation: \
#   memcap 500, \
#   priority whitelist, \
#   nested_ip inner, \
#   whitelist $WHITE_LIST_PATH/white_list.rules, \
#   blacklist $BLACK_LIST_PATH/black_list.rules 

###################################################
# Step #6: Configure output plugins
# For more information, see Snort Manual, Configuring Snort - Output Modules
###################################################

# unified2 
# Recommended for most installs
# output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types

# Additional configuration for specific types of installs
# output alert_unified2: filename snort.alert, limit 128, nostamp
# output log_unified2: filename snort.log, limit 128, nostamp 

# syslog
# output alert_syslog: LOG_AUTH LOG_ALERT

# pcap
# output log_tcpdump: tcpdump.log

# database
# output database: alert, <db_type>, user=<username> password=<password> test dbname=<name> host=<hostname>
# output database: log, <db_type>, user=<username> password=<password> test dbname=<name> host=<hostname>

# prelude
# output alert_prelude

# output snortm_packet_alert: port 9318

# metadata reference data.  do not modify these lines
include classification.config
include reference.config

###################################################
# Step #7: Customize your rule set
# For more information, see Snort Manual, Writing Snort Rules
#
# NOTE: All categories are enabled in this conf file
###################################################

# site specific rules
#include $RULE_PATH/all.rules

alert udp any 500 -> any 500 (msg:"DOS Nbisakmp"; classtype: attempted-dos; sid:1000001; rev:1;)

###################################################
# Step #8: Customize your preprocessor and decoder alerts
# For more information, see README.decoder_preproc_rules
###################################################

# decoder and preprocessor event rules
# include $PREPROC_RULE_PATH/preprocessor.rules
# include $PREPROC_RULE_PATH/decoder.rules
# include $PREPROC_RULE_PATH/sensitive-data.rules

###################################################
# Step #9: Customize your Shared Object Snort Rules
# For more information, see http://vrt-sourcefire.blogspot.com/2009/01/using-vrt-certified-shared-object-rules.html
###################################################

# dynamic library rules

# Event thresholding or suppression commands. See threshold.conf 
include threshold.conf
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Arun Saini | 23 Jun 12:37 2016
Picon

Fwd: Snort My SQL DB

Hi,

we are using Barnyard2 version 2.1.13<build 327> and
​attached ​
error sc
​r​
e
​e​
n shot
​for information​
,

 snort version 2.9.5.5 GRE [build 205]
libpcap version 1.3.0
PCRE 8.30 2012-02-04
Zlib 1.2.7

Mysql snort databese tables,

mysql> show tables;
+------------------+
| Tables_in_snort  |
+------------------+
| acid_ag          |
| acid_ag_alert    |
acid_event         |
| acid_ip_cache    |
| base_roles       |
| base_users       |
| data             |
| detail           |
| encoding         |
| event            |
| icmphdr          |
| iphdr            |
| opt              |
| reference        |
| reference_system |
| schema           |
| sensor           |
| sig_class        |
| sig_reference    |
| signature        |
| tcphdr           |
| udphdr           |
+------------------+
do we need  acid_event  table in our database it ? or please suggest us whether do we actually require"acid_ag          |
| acid_ag_alert    |
acid_event         |
| acid_ip_cache "

in our database ?
it is the table where the screen shot saying that the events are not found the way...
surely we will upgrade our snort but just want to diagnose why this error is coming on screen.


​Sincerely,
Arun Saini
Mobile :+91-9890738762

On 23 June 2016 at 07:33, Joel Esler (jesler) <jesler <at> cisco.com> wrote:
I would help us tremendously if you could tell us what version of Barnyard2 you are using, what error you are receiving, and even, if you could update your version of Snort, to something that is supported, that'd be great too.

--
Joel Esler
Manager, Talos Group
Sent from my iPad

On Jun 22, 2016, at 9:24 PM, Arun Saini <mailarunsaini <at> gmail.com> wrote:

Hi,
Can anyone help me to know the table names under mysql dB for snort from where Base read the data,actually I have a table named as acid_events and acid_cache where some of the records/data failed to inset, and on base screen I get notification I.e.alerts have NOT found their way into acid " please see attached screen , requesting you to please help us to resolve the issue ..

we are using snort version 2.9.5.5 GRE [build 205]

libpcap version 1.3.0

PCRE 8.30 2012-02-04

Zlib 1.2.7

I can provide the screen shot if required!!!

​​
​​
Sincerely,

Arun Saini
Mobile :+91-9890738762

   

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Snort Releases | 23 Jun 18:27 2016

Snort++ Build 201 Available Now

Snort++ build 201 is now available on snort.org.  This is the latest monthly update available for download.  You can also get the latest updates from github (snortadmin/snort3) which is updated weekly.

Enhancements:

* add configure --enable-hardened-build
* add configure --pie (position independent executable)
* add new_http_inspect alert for loss of sync
* add peg counts for new_http_inspect
* add peg counts for sd_pattern
* add file_log inspector to log file events
* add filename support to file daq
* update file processing configuration
* add high availability support for udp and icmp
* add support for safe C library
* add new http_inspect alerts abusive content-length and transfer-encodings
* add \b matching to sensitive data
* add obfuscation for sensitive data
* add support for unprivileged operation
* convert legacy allocations to memory manager for better memory profiling
* add double-decoding to new_http_inspect
* add obfuscation support for cmg and unified2

Bug Fixes:

* various snort2lua updates and fixes
* fix default prime tables for internal hash functions
* fix new_http_inspect bounds issues
* miscellaneous cmake and auto tools build fixes
* add / update unit tests
* fix additional memory leaks
* fix compiler warnings
* fix static analysis issues
* fix handling of bpf file failures
* fix link with dynamic DAQ
* fix multi-DAQ instance configuration
* prevent profiler double counting on recursion

Other Changes:

* initial appid port - in progress
* continued porting of dce_rpc - smb transaction processing
* openssl is now a mandatory dependency
* DAQ 2.1 has many updates - see the ChangeLog for details

Please submit bugs, questions, and feedback to bugs <at> snort.org or the Snort-Users mailing list.

Happy Snorting!
The Snort Release Team

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Rich Lee | 23 Jun 11:04 2016
Picon
Gravatar

Razorback

Can anybody - maybe Joel :) - please tell me the status of project Razorback?

It's listed as one of the projects on the Snort/Projects page, but the sourceforge(!) repo has had some minor-looking changes in mid-2015 otherwise quiet since early 2012.

TIA
Rich Lee
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Arun Saini | 23 Jun 03:21 2016
Picon

Snort My SQL DB

Hi,
Can anyone help me to know the table names under mysql dB for snort from where Base read the data,actually I have a table named as acid_events and acid_cache where some of the records/data failed to inset, and on base screen I get notification I.e.alerts have NOT found their way into acid " please see attached screen , requesting you to please help us to resolve the issue ..

we are using snort version 2.9.5.5 GRE [build 205]

libpcap version 1.3.0

PCRE 8.30 2012-02-04

Zlib 1.2.7

I can provide the screen shot if required!!!

Sincerely,

Arun Saini
Mobile :+91-9890738762

   

------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!
Pratibha Rajan | 23 Jun 01:19 2016
Picon

Snort BASE compatibility

Hi,

Is Snort 2.9.8.x compatible with BASE - 1.4.5?

Thank you
------------------------------------------------------------------------------
Attend Shape: An AT&T Tech Expo July 15-16. Meet us at AT&T Park in San
Francisco, CA to explore cutting-edge tech and listen to tech luminaries
present their vision of the future. This family event has something for
everyone, including kids. Get more information and register today.
http://sdm.link/attshape
_______________________________________________
Snort-users mailing list
Snort-users <at> lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Gmane