Re: Snort signature packet generator

From: Dirk Geschke (Dirk_Geschke_at_genua.de)
Date: 11/08/04

  • Next message: Don Parker: "Re: TippingPoint Releases Open Source Code for FirstIntrusionPrev ention Test Tool, Tomahawk" 
    Date: Mon, 8 Nov 2004 17:37:37 +0100
To: Graeme Connell <gconnell@middlebury.edu>

    Hi Graeme,

    > I'm attempting to train a neural network using snort, and I'm having
    > trouble getting a good number of "bad" packets, IE: those that snort
    > considers malicious. Since a snort signature is really just a
    > definition of a subset of all possible packets, it seems like it should
    > be possible to create a packet that snort considers bad by filling in
    > packet fields based on a snort signature, then filling the rest of the
    > packet with random garbage. Does anyone know if this type of program
    > has already been created, and if so, where could I find it? Thanks.

    fpg, the false-positive generator does exact this. But actually not
    all keywords are supported. Especially pcre is difficult to implement.

    fpg is part of the Fast Logging Project for snort: FLoP

    You can find it at

      http://www.geschke-online.de/FLoP/

    The manual page for fpg is online available:

      http://www.geschke-online.de/FLoP/fpg.8.html

    But note: For TCP the most alerts will not work as long as stream4
    is used (or equivalent the established flag is set). To get all alerts
    you should disable stream4 for this case.

    Best regards

    Dirk

    --------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from
    CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    --------------------------------------------------------------------------

  • Next message: Don Parker: "Re: TippingPoint Releases Open Source Code for FirstIntrusionPrev ention Test Tool, Tomahawk"

    Relevant Pages

    • RE: Snort signature packet generator
      ... > Subject: Snort signature packet generator ... > CORE IMPACT. ... Find out quickly and easily by testing it with real-world attacks from ...
      (Focus-IDS)
    • RE: Snort signature packet generator
      ... Subject: Snort signature packet generator ... Find out quickly and easily by testing it with real-world attacks from ... CORE IMPACT. ...
      (Focus-IDS)
    • RE: Snort signature packet generator
      ... Subject: Snort signature packet generator ... fpg is part of the Fast Logging Project for snort: ... Test Your IDS ...
      (Focus-IDS)
    • Snort signature packet generator
      ... I'm attempting to train a neural network using snort, ... packet fields based on a snort signature, then filling the rest of the ...
      (Focus-IDS)