RE: Snort signature packet generator

From: Leandro Reox (lmet5on_at_fibertel.com.ar)
Date: 11/11/04

  • Next message: Gary Freeman: "Snort vs. compressed HTML" 
    To: "'Dirk Geschke'" <Dirk_Geschke@genua.de>, "'Graeme Connell'" <gconnell@middlebury.edu>
Date:	Thu, 11 Nov 2004 01:29:40 -0300

    Hi Graeme.

    We use this tool to test ids like ISS Server Sensor and other products,
    and works great, its idswakeup, you can obtain it from here :

    http://www.hsc.fr/ressources/outils/idswakeup/index.html.en

    Cheers !

    -----Original Message-----
    From: Dirk Geschke [mailto:Dirk_Geschke@genua.de]
    Sent: Lunes, 08 de Noviembre de 2004 01:38 p.m.
    To: Graeme Connell
    Cc: focus-ids@securityfocus.com
    Subject: Re: Snort signature packet generator

    Hi Graeme,

    > I'm attempting to train a neural network using snort, and I'm having
    > trouble getting a good number of "bad" packets, IE: those that snort
    > considers malicious. Since a snort signature is really just a
    > definition of a subset of all possible packets, it seems like it
    should
    > be possible to create a packet that snort considers bad by filling in
    > packet fields based on a snort signature, then filling the rest of the

    > packet with random garbage. Does anyone know if this type of program
    > has already been created, and if so, where could I find it? Thanks.

    fpg, the false-positive generator does exact this. But actually not
    all keywords are supported. Especially pcre is difficult to implement.

    fpg is part of the Fast Logging Project for snort: FLoP

    You can find it at

      http://www.geschke-online.de/FLoP/

    The manual page for fpg is online available:

      http://www.geschke-online.de/FLoP/fpg.8.html

    But note: For TCP the most alerts will not work as long as stream4
    is used (or equivalent the established flag is set). To get all alerts
    you should disable stream4 for this case.

    Best regards

    Dirk

    ------------------------------------------------------------------------ 

    --
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
--
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.788 / Virus Database: 533 - Release Date: 01/11/2004
 
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.788 / Virus Database: 533 - Release Date: 01/11/2004
 
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------
  • Next message: Gary Freeman: "Snort vs. compressed HTML"

    Relevant Pages

    • RE: Snort signature packet generator
      ... Snort/any IDS think an actual attack is taking place. ... attacks from its attack selector. ... Subject: Snort signature packet generator ...
      (Focus-IDS)
    • RE: Intrusion Prevention requirements document
      ... The tools consider one interface as "client" and other ... Packet 1 is first sent out on client interface. ... > my previous company was Blade Software where I developed IDS Informer ... Up to 75% of cyber attacks are launched on shopping carts, ...
      (Pen-Test)
    • RE: Intrusion Prevention requirements document
      ... The tools consider one interface as "client" and other ... Packet 1 is first sent out on client interface. ... > The product uses two network cards and so the library of over 700 ... > my previous company was Blade Software where I developed IDS Informer ...
      (Focus-IDS)
    • RE: Value of "richer" signatures?
      ... Is it that much faster to do "protocol parsing" than ... > Here's an example of how the newer IDS signatures help ... > Let's say you are using a simple packet grepping IDS ...
      (Focus-IDS)
    • Re: Snort + (OpenBSD or Linux)
      ... Snort + (OpenBSD or Linux) ... many of them begin way before the IDS application even receives a single ... From there your NIC has to make interrupt requests to get more ... your OS for example) and then your application having to copy the packet ...
      (Focus-IDS)