Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Quick Snort Setup Instructions for New Users

    Scheduled Pinned Locked Moved IDS/IPS
    147 Posts 46 Posters 259.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      Fobio
      last edited by

      @Mr.:

      @Fobio:

      I have setup snort and it's been running well.  Thank you for those here with the setup tips.

      Today I tried to download FireFox and it all timed out to address: download-installer.cdn.mozilla.net

      I've followed the setup and disabled the ET-Policy-Mozilla rule.  What else could be affecting this?  I've done a few searches and haven't found anything here or elsewhere.

      Normally the alerts tab for the interface should give a clue, does it say anything?

      Likely this:

      1:2003492 ET MALWARE Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)

      1 Reply Last reply Reply Quote 0
      • VeldkornetV
        Veldkornet
        last edited by

        Hey guys,

        I keep getting the following alert "2000419 ET POLICY PE EXE or DLL Windows file download" but I dot even have emerging-policy.rules enabled (I never have)….. I only have
        emerging-botcc.rules
        emerging-compromised.rules
        emerging-dshield.rules
        emerging-exploit.rules
        emerging-malware.rules
        emerging-trojan.rules
        emerging-worm.rules

        Is it possible that it's coming from one of these other categories?

        I've force disabled it for now, but I have no idea why it's showing up...

        1 Reply Last reply Reply Quote 0
        • D
          djseto
          last edited by

          @jflsakfja:

          The Missing Part to Quick Snort Setup Instructions for New Users

          Instructions on making the most of your shiny new IDS
          Snort is designed to block pretty much anything you can think of. That's why there are many false positives. When I first started using snort, I was constantly banging my head on my desk because most sites would be blocked for (seemingly) no reason.
          The CORRECT way to stop false positives is to disable the rules causing them, NOT using suppression lists. I may hear you ask "but all other places on the internet say use suppression lists, why shouldn't I?".
          A little (simplified) info on how snort works will help you understand why.
          Snort takes the packets and analyses them. Matches to the rules will be forwarded to alerts, then pfsense's plugin takes over and bans them. Suppression lists work just before the last step. They stop alerts from being produced. Disabling rules stops the "process" at the very beginning. Why analyze a packet if you are going to ignore it? This saves CPU processing which could be used for other purposes (eg enable more rules).
          There are times when this will not work. Rules deep deep inside snort (preprocessor rules) have no way of being disabled (if I'm wrong about this, please correct me). That's where suppression lists become useful.

          With that out of the way, this is the process to stop false positives.

          1. Identify the rule causing them. On the alerts tab you will find all alerts (no kidding). The last columns should show a number in the format x:YYYY:x and an explanation for the rule.
            I'll use this for this example:
            x:2000419:x ET POLICY PE EXE or DLL Windows file download
          2. copy the YYYY part (2000419). Take a look at the explanation. ET (emerging threats) POLICY. This means you'll find this rule in emerging-policy list.
          3. go to the snort home page (services> snort). Click the e to edit interface settings, then go to rules. In the drop down select emerging-policy. Assuming you use firefox, CTRL+F and paste the rule number (called sig_id, signature ID) and click next. For other browsers, find a way to search the page for a term and enter the number there.
          4. click the red or yellow (depending if you previously enabled the rule) to turn it into a lighter shade of yellow (see bottom of page).
          5. top of page, click apply changes and wait for the page to reload.
          6. go back to the snort home page and restart the interface (click the red x until it becomes green, wait a couple of seconds and click it again to turn it back to red) <<< DO NOT FORGET THIS STEP
            –----warning!!!-------
            as of version 2.5.8 the icons are now swapped. Green is running, red is not running. So invert the colors above

          1. relax, the rule is now disabled and will stop generating alerts. Go to blocked tab, and find the ip that it previously banned and unban it (click the button to the right of the explanation).

          In that rare case you cannot find the rule causing the alert (eg explanation does not offer information about the list), first check GPLv2 list, then IPS policy list. If you still cannot find it, a suppression entry is needed. Simply click the add to suppression list (little +) next to the rule on the alerts tab. Assuming you have set up your suppression list correctly, it will be added to it. Restart the interface (step 6 above), unban the ip, and you are done!

          And now for my contribution to the community. The default enabled rules are too relaxed. We need to enable more rules, but a word of caution. ONLY USE THIS LIST IF YOU HAVE ENOUGH MEMORY.
          I'm currently using it on redundant CARP firewalls, with a crappy p4 cpu and 2GB of ram each. The systems average about 25-30% RAM usage.The list below shows how snort is configured on a production environment and works perfectly (for me) but it is not complete. Entries that do not have a DONE > in front of them are NOT COMPLETED. Please review and make changes depending on your environment.

          In tab "Rules", under "Category" select:
          (--- means blank table at time of writing)

          DONE > emerging-activex > all

          DONE > emerging-attack_responses > all

          DONE > emerging-botcc > all

          DONE > emerging-chat > all except:
          2010784 ET CHAT Facebook Chat (send message)
          2010785 ET CHAT Facebook Chat (buddy list)
          2010786 ET CHAT Facebook Chat (settings)
          2010819 ET CHAT Facebook Chat using XMPP
          2002327 ET CHAT Google Talk (Jabber) Client Login
          2002334 ET CHAT Google IM traffic Jabber client sign-on
          2001241 ET CHAT MSN file transfer request
          2001242 ET CHAT MSN file transfer accept
          2001243 ET CHAT MSN file transfer reject
          2001682 ET CHAT MSN IM Poll via HTTP
          2002192 ET CHAT MSN status change
          2008289 ET CHAT Possible MSN Messenger File Transfer
          2009375 ET CHAT General MSN Chat Activity
          2009376 ET CHAT MSN User-Agent Activity

          DONE > emerging-ciarmy > all

          DONE > emerging-compromised > all

          DONE > emerging-current_events > all

          DONE > emerging-deleted > ---

          DONE > emerging-dns > all except:
          2008446 ET DNS Excessive DNS Responses with 1 or more RR's (100+ in 10
          seconds) - possible Cache Poisoning Attempt
          2008470 ET DNS Excessive NXDOMAIN responses - Possible DNS Backscatter or Domain Generation Algorithm Lookups
          2001117 ET DNS Standard query response, Name Error

          DONE > emerging-dos > all

          DONE > emerging-drop > all

          DONE > emerging-dshield > all

          DONE > emerging-exploit > all except:
          2001058 ET EXPLOIT libpng tRNS overflow attempt
          2002913 ET EXPLOIT VNC Client response
          2002914 ET EXPLOIT VNC Server VNC Auth Offer
          2002919 ET EXPLOIT VNC Good Authentication Reply
          2002915 ET EXPLOIT VNC Authentication Reply
          2002758 ET EXPLOIT WMF Escape Record Exploit - Version 1
          2002742 ET EXPLOIT WMF Escape Record Exploit - Version 3

          DONE > emerging-ftp > all

          DONE > emerging-games > all

          DONE > emerging-icmp > ---

          DONE > emerging-icmp_info > ---

          DONE > emerging-imap > ---

          DONE > emerging-inappropriate > all except:
          2002925 ET INAPPROPRIATE Google Image Search, Safe Mode Off
          2001608 ET INAPPROPRIATE Likely Porn

          DONE > emerging-info > all except:
          2014472 ET INFO JAVA - Java Archive Download
          2014473 ET INFO JAVA - Java Archive Download By Vulnerable Client
          2014819 ET INFO Packed Executable Download
          2015016 ET INFO FTP STOR to External Network
          2015561 ET INFO PDF Using CCITTFax Filter
          2015744 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
          2016360 ET INFO JAVA - ClassID
          2016361 ET INFO JAVA - ClassID
          2016404 ET INFO MPEG Download Over HTTP (1)

          DONE > emerging-malware > all except:
          2008438 ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

          DONE > emerging-misc > all

          DONE > emerging-mobile_malware > all except:
          2012251 ET MOBILE_MALWARE Google Android Device HTTP Request
          2012848 ET MOBILE_MALWARE Possible Mobile Malware POST of IMEI International Mobile Equipment Identity in URI

          DONE > emerging-netbios > all

          DONE > emerging-p2p > all except:
          2000369 ET P2P BitTorrent Announce
          2007727 ET P2P possible torrent download
          2008581 ET P2P BitTorrent DHT ping request
          2008583 ET P2P BitTorrent DHT nodes reply
          2008585 ET P2P BitTorrent DHT announce_peers request
          2010144 ET P2P Vuze BT UDP Connection (5)
          2011699 ET P2P Bittorrent P2P Client User-Agent (Transmission/1.x)

          *emerging-policy > all except:
          2000419 ET POLICY PE EXE or DLL Windows file download
          2000428 ET POLICY ZIP file download
          2001115 ET POLICY MSI (microsoft installer file) download
          2003595 ET POLICY exe download via HTTP - Informational
          2001898 ET POLICY eBay Bid Placed
          2001907 ET POLICY eBay Placing Item for sale
          2001908 ET POLICY eBay View Item
          2001909 ET POLICY eBay Watch This Item
          2003303 ET POLICY FTP Login Attempt (non-anonymous)
          2003410 ET POLICY FTP Login Successful
          2003121 ET POLICY docs.google.com Activity
          2003597 ET POLICY Google Calendar in Use
          2002801 ET POLICY Google Desktop User-Agent Detected
          2002838 ET POLICY Google Search Appliance browsing the Internet
          2000035 ET POLICY Hotmail Inbox Access
          2000036 ET POLICY Hotmail Message Access
          2000037 ET POLICY Hotmail Compose Message Access
          2000038 ET POLICY Hotmail Compose Message Submit
          2000039 ET POLICY Hotmail Compose Message Submit Data
          2008238 ET POLICY Hotmail Inbox Access
          2008239 ET POLICY Hotmail Message Access
          2008240 ET POLICY Hotmail Compose Message Access
          2008242 ET POLICY Hotmail Access Full Mode
          2006408 ET POLICY HTTP Request on Unusual Port Possibly Hostile
          2006409 ET POLICY HTTP POST on unusual Port Possibly Hostile
          2002330 ET POLICY Google Talk TLS Client Traffic
          2002332 ET POLICY Google IM traffic Windows client user sign-on
          2002333 ET POLICY Google IM traffic friend invited
          2002878 ET POLICY iTunes User Agent
          2002722 ET POLICY MP3 File Transfer Outbound
          2002723 ET POLICY MP3 File Transfer Inbound
          2001114 ET POLICY Mozilla XPI install files download
          2001973 ET POLICY SSH Server Banner Detected on Expected Port
          2001974 ET POLICY SSH Client Banner Detected on Expected Port
          2001975 ET POLICY SSHv2 Server KEX Detected on Expected Port
          2001976 ET POLICY SSHv2 Client KEX Detected on Expected Port
          2001977 ET POLICY SSHv2 Client New Keys detected on Expected Port
          2001978 ET POLICY SSH session in progress on Expected Port
          2001979 ET POLICY SSH Server Banner Detected on Unusual Port
          2001980 ET POLICY SSH Client Banner Detected on Unusual Port
          2001981 ET POLICY SSHv2 Server KEX Detected on Unusual Port
          2001982 ET POLICY SSHv2 Client KEX Detected on Unusual Port
          2001983 ET POLICY SSHv2 Client New Keys Detected on Unusual Port
          2001984 ET POLICY SSH session in progress on Unusual Port
          2013031 ET POLICY Python-urllib/ Suspicious User Agent
          2013414 ET POLICY Executable served from Amazon S3
          2014297 ET POLICY Vulnerable Java Version 1.7.x Detected
          2012647 ET POLICY Dropbox.com Offsite File Backup in Use
          2012648 ET POLICY Dropbox Client Broadcasting
          2014313 ET POLICY Executable Download From DropBox

          DONE > emerging-pop3 > ---

          DONE > emerging-rbn-malvertisers > all

          DONE > emerging-rbn > all

          DONE > emerging-rpc > ---

          DONE > emerging-scada > all

          DONE > emerging-scan > all except
          2002992 ET SCAN Rapid POP3 Connections - Possible Brute Force Attack
          2002993 ET SCAN Rapid POP3S Connections - Possible Brute Force Attack
          2002994 ET SCAN Rapid IMAP Connections - Possible Brute Force Attack
          2002995 ET SCAN Rapid IMAPS Connections - Possible Brute Force Attack

          DONE > emerging-shellcode > all except
          2011803 ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
          2012252 ET SHELLCODE Common 0a0a0a0a Heap Spray String
          2012257 ET SHELLCODE Common %0c%0c%0c%0c Heap Spray String
          2012510 ET SHELLCODE UTF-8/16 Encoded Shellcode
          2013222 ET SHELLCODE Excessive Use of HeapLib Objects Likely Malicious Heap Spray Attempt
          2013267 ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 0a0a0a0a

          DONE > emerging-smtp > all

          DONE > emerging-snmp > all

          DONE > emerging-sql > all

          DONE > emerging-telnet > all

          DONE > emerging-tftp > all

          DONE > emerging-tor > all

          emerging-trojan > all except

          DONE > emerging-user_agents > all except:
          2010697 ET USER_AGENTS Suspicious User-Agent Beginning with digits - Likely spyware/trojan

          DONE > emerging-voip > all

          DONE > emerging-web_client > all except
          2011347 ET WEB_CLIENT Possible String.FromCharCode Javascript Obfuscation Attempt
          2011507 ET WEB_CLIENT PDF With Embedded File
          2010518 ET WEB_CLIENT Possible HTTP 404 XSS Attempt (External Source)
          2012119 ET WEB_CLIENT Possible Hex Obfuscation Usage On Webpage
          2012205 ET WEB_CLIENT Possible Malicious String.fromCharCode with charCodeAt String
          2012266 ET WEB_CLIENT Hex Obfuscation of unescape % Encoding
          2012272 ET WEB_CLIENT Hex Obfuscation of eval % Encoding
          2012398 ET WEB_CLIENT Hex Obfuscation of replace Javascript Function % Encoding

          DONE > emerging-web_server > all except
          2003099 ET WEB_SERVER Poison Null Byte

          emerging-web_specific_apps > all except:
          2010890 ET WEB_SPECIFIC_APPS phpBB3 registration (Step1 GET)
          2010891 ET WEB_SPECIFIC_APPS phpBB3 registration (Step2 POST)
          2010892 ET WEB_SPECIFIC_APPS phpBB3 registration (Step3 GET)
          2010893 ET WEB_SPECIFIC_APPS phpBB3 registration (Step4 POST)

          DONE > emerging-worm > all

          DONE > GPLv2 community rules > all except
          254 DNS SPOOF query response with TTL of 1 min. and no authority
          384 PROTOCOL-ICMP PING
          385 PROTOCOL-ICMP traceroute
          399 PROTOCOL-ICMP Destination Unreachable Host Unreachable
          402 PROTOCOL-ICMP Destination Unreachable Port Unreachable
          408 PROTOCOL-ICMP Echo Reply
          540 POLICY-SOCIAL Microsoft MSN message
          648 INDICATOR-SHELLCODE x86 NOOP
          649 INDICATOR-SHELLCODE x86 setgid 0
          1200 INDICATOR-COMPROMISE Invalid URL
          1201 INDICATOR-COMPROMISE 403 Forbidden
          1292 INDICATOR-COMPROMISE directory listing
          1390 INDICATOR-SHELLCODE x86 inc ebx NOOP
          1394 INDICATOR-SHELLCODE x86 inc ecx NOOP
          1437 FILE-IDENTIFY Microsoft Windows Media download detected
          1841 FILE-OTHER Oracle Javascript URL host spoofing attempt
          1846 POLICY-MULTIMEDIA vncviewer Java applet download attempt
          1852 SERVER-WEBAPP robots.txt access
          1986 POLICY-SOCIAL Microsoft MSN outbound file transfer request
          1988 POLICY-SOCIAL Microsoft MSN outbound file transfer accept
          1989 POLICY-SOCIAL Microsoft MSN outbound file transfer rejected
          1990 POLICY-SOCIAL Microsoft MSN user search
          1991 POLICY-SOCIAL Microsoft MSN login attempt
          2180 PUA-P2P BitTorrent announce request
          2181 PUA-P2P BitTorrent transfer
          2707 FILE-IMAGE JPEG parser multipacket heap overflow
          3463 SERVER-WEBAPP awstats access
          25518 OS-OTHER Apple iPod User-Agent detected
          25519 OS-OTHER Apple iPad User-Agent detected
          25520 OS-OTHER Apple iPhone User-Agent detected
          25521 OS-OTHER Android User-Agent detected
          25522 OS-OTHER Nokia User-Agent detected
          25523 OS-OTHER Samsung User-Agent detected
          25524 OS-OTHER Kindle User-Agent detected
          25525 OS-OTHER Nintendo User-Agent detected

          *IPS Policy - Security > all except
          4152 BROWSER-PLUGINS Microsoft Windows Media Player 6.4 ActiveX object access
          19436 BROWSER-IE Microsoft Internet Explorer CStyleSheetRule array memory corruption attempt

          Suppression List:
          #GLOBAL

          gen_id 1

          suppress gen_id 1, sig_id 536
          suppress gen_id 1, sig_id 648
          suppress gen_id 1, sig_id 653
          suppress gen_id 1, sig_id 1390
          suppress gen_id 1, sig_id 2452
          suppress gen_id 1, sig_id 11192
          suppress gen_id 1, sig_id 15306
          suppress gen_id 1, sig_id 16313
          suppress gen_id 1, sig_id 17458
          suppress gen_id 1, sig_id 20583
          suppress gen_id 1, sig_id 23098
          suppress gen_id 1, sig_id 2000334
          suppress gen_id 1, sig_id 2008120
          suppress gen_id 1, sig_id 2010516
          suppress gen_id 1, sig_id 20122758
          suppress gen_id 1, sig_id 2014518
          suppress gen_id 1, sig_id 2014520
          suppress gen_id 1, sig_id 2100366
          suppress gen_id 1, sig_id 2100368
          suppress gen_id 1, sig_id 2100651
          suppress gen_id 1, sig_id 2101390
          suppress gen_id 1, sig_id 2101424
          suppress gen_id 1, sig_id 2102314
          suppress gen_id 1, sig_id 2103134
          suppress gen_id 1, sig_id 2500056
          suppress gen_id 1, sig_id 100000230
          suppress gen_id 3, sig_id 14772
          #(http_inspect) DOUBLE DECODING ATTACK
          suppress gen_id 119, sig_id 2
          #(http_inspect) BARE BYTE UNICODE ENCODING
          suppress gen_id 119, sig_id 4
          #(http_inspect) IIS UNICODE CODEPOINT ENCODING
          suppress gen_id 119, sig_id 7
          #(http_inspect) NON-RFC DEFINED CHAR [**]
          suppress gen_id 119, sig_id 14
          #(http_inspect) UNKNOWN METHOD
          suppress gen_id 119, sig_id 31
          #(http_inspect) SIMPLE REQUEST
          suppress gen_id 119, sig_id 32
          #(http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE
          suppress gen_id 120, sig_id 2
          #(http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE
          suppress gen_id 120, sig_id 3
          #(http_inspect) HTTP RESPONSE HAS UTF CHARSET WHICH FAILED TO NORMALIZE
          suppress gen_id 120, sig_id 4
          #(http_inspect) HTTP RESPONSE GZIP DECOMPRESSION FAILED
          suppress gen_id 120, sig_id 6
          #(http_inspect) INVALID CONTENT-LENGTH OR CHUNK SIZE
          suppress gen_id 120, sig_id 8
          #(http_inspect) JAVASCRIPT OBFUSCATION LEVELS EXCEEDS 1
          suppress gen_id 120, sig_id 9

          Unknown

          suppress gen_id 120, sig_id 10
          #(smtp) Attempted response buffer overflow: 1448 chars
          suppress gen_id 124, sig_id 3
          #(ftp_telnet) Invalid FTP Command
          suppress gen_id 125, sig_id 2
          #(ssp_ssl) Invalid Client HELLO after Server HELLO Detected
          suppress gen_id 137, sig_id 1
          #(IMAP) Unknown IMAP4 command
          suppress gen_id 141, sig_id 1

          I did the above and I'm getting this error in my System Logs and Snort isn't starting:

          FATAL ERROR: /usr/local/etc/snort/snort_63694_igb0/rules/snort.rules(5021) byte_test rule option cannot extract more than 4 bytes without valid string prefix.

          1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks
            last edited by

            @djseto:

            I did the above and I'm getting this error in my System Logs and Snort isn't starting:

            FATAL ERROR: /usr/local/etc/snort/snort_63694_igb0/rules/snort.rules(5021) byte_test rule option cannot extract more than 4 bytes without valid string prefix.

            Have you searched this sub-forum using the error message text?  If you do, you should encounter this recent thread with your answer:
            https://forum.pfsense.org/index.php?topic=130993.msg722272#msg722272.

            Bill

            1 Reply Last reply Reply Quote 0
            • B
              bimmerdriver
              last edited by

              OP, thank you for providing this guide.

              I have some questions.

              @bmeeks:

              16.  Click the Preprocessors tab.

              17.  Scroll down into the General Preprocessor Settings area and then check (or enable) all of the preprocessors listed in that section EXCEPT the Sensitive Data preprocessor.  It can cause a lot of alerts and is best used after you gain some experience with Snort.

              It's not clear which section of preprocessors you are talking about. There is no General Preprocessor Settings area.

              @bmeeks:

              19.  Now click on the Categories tab.  This is where we will choose a threat detection policy and associated rules.

              20.  If you followed my advice for Snort VRT rules, this page is easy.  Just click the check box for "Use IPS Policy" and then select "Connectivity" in the drop-down.  Click Save and you're done!  Once you gain some experience with Snort, you can come back and choose one of the other two more restrictive policies.  I personally run "Balanced", but it will require some tuning if run in blocking mode.

              What is the difference between Connectivity and Balanced. The description does not explain the difference.

              Connectivity blocks most major threats with few or no false positives. Balanced is a good starter policy.
              It is speedy, has good base coverage level, and covers most threats of the day. It includes all rules in Connectivity.

              1 Reply Last reply Reply Quote 0
              • M
                Mr. Jingles
                last edited by

                @bimmerdriver:

                OP, thank you for providing this guide.

                I have some questions.

                @bmeeks:

                16.  Click the Preprocessors tab.

                17.  Scroll down into the General Preprocessor Settings area and then check (or enable) all of the preprocessors listed in that section EXCEPT the Sensitive Data preprocessor.  It can cause a lot of alerts and is best used after you gain some experience with Snort.

                It's not clear which section of preprocessors you are talking about. There is no General Preprocessor Settings area.

                @bmeeks:

                19.  Now click on the Categories tab.  This is where we will choose a threat detection policy and associated rules.

                20.  If you followed my advice for Snort VRT rules, this page is easy.  Just click the check box for "Use IPS Policy" and then select "Connectivity" in the drop-down.  Click Save and you're done!  Once you gain some experience with Snort, you can come back and choose one of the other two more restrictive policies.  I personally run "Balanced", but it will require some tuning if run in blocking mode.

                What is the difference between Connectivity and Balanced. The description does not explain the difference.

                Connectivity blocks most major threats with few or no false positives. Balanced is a good starter policy.
                It is speedy, has good base coverage level, and covers most threats of the day. It includes all rules in Connectivity.

                First: what bimmer do you drive? I have an E39, and a F01  :) Which one do you have? Engine? Automatic gear or manual? Color? Most important Options? In Bimmer world, we are One Big Family  :-*

                1. The General Preprocessor Settings indeed is gone. My guess is it is now 'Basic configuration settings', and a lot of other settings that used to be in 'General settings'. I think you could accept the defaults. 'Sensititive data' is now a separate setting all together: unflag it.
                2. "Connectivity" versus "balanced" is described: one is more restrictive than the other. It is really nothing more than this: in one setting more categories and rules are enabled than in the other, by default. If you wish to know which ones, enable one settings, and then inspect the rules-tab to find out. It is just a helpful default suggestion from Bill, nothing more. He didn't write a tutorial for stuff you can easily see yourself by simply enabling the setting  ;)

                6 and a half billion people know that they are stupid, agressive, lower life forms.

                1 Reply Last reply Reply Quote 0
                • B
                  bimmerdriver
                  last edited by

                  @Mr.:

                  First: what bimmer do you drive? I have an E39, and a F01  :) Which one do you have? Engine? Automatic gear or manual? Color? Most important Options? In Bimmer world, we are One Big Family  :-*

                  I drive an E46, specifically 2002 M3 MT coupe with a lot of mods. Using your family analogy, your F01 is the stately father and my E46 is the kid that gets into a lot of trouble. E39 and F01 is an interesting combo. What are their year / model? An E39 M5 would be a nice alternate to an F01.

                  @Mr.:

                  1. The General Preprocessor Settings indeed is gone. My guess is it is now 'Basic configuration settings', and a lot of other settings that used to be in 'General settings'. I think you could accept the defaults. 'Sensititive data' is now a separate setting all together: unflag it.
                  2. "Connectivity" versus "balanced" is described: one is more restrictive than the other. It is really nothing more than this: in one setting more categories and rules are enabled than in the other, by default. If you wish to know which ones, enable one settings, and then inspect the rules-tab to find out. It is just a helpful default suggestion from Bill, nothing more. He didn't write a tutorial for stuff you can easily see yourself by simply enabling the setting  ;)

                  Okay, that's what I thought.

                  1 Reply Last reply Reply Quote 0
                  • M
                    maniak
                    last edited by

                    @bmeeks:

                    8.  Click the Snort Interfaces tab and then click the plus "+" icon to add a Snort interface.

                    9.  On the If Settings tab, click the Enable checkbox.

                    10.  In the drop-down, choose the interface.  The WAN interface is the default and is a good first choice.

                    11.  In the Description textbox, enter a name (WAN again, is fine here).

                    I have several OpenVPN clients that run as interfaces. Should I add them also in Snort interfaces or is it enough with just WAN?

                    Thanks for this great post. I followed your post and also watched this tutorial https://youtu.be/-GgqYq5-EBg

                    Thanks again!

                    1 Reply Last reply Reply Quote 0
                    • QinnQ
                      Qinn
                      last edited by Qinn

                      New to Snort I follow this one https://www.youtube.com/watch?v=-GgqYq5-EBg&feature=youtu.be and setup accordingly only one interface eg the WAN.
                      Strange enough I only see one source ip address (LAN) in the Alerts tab. I have 10 subnets, with many users using the internet, what am I overlooking?

                      For instance in PFBlockerNG-develop I am see enough of the IP's of the subnets.

                      Cheers Qinn

                      Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                      Firmware: Latest-stable-pfSense CE (amd64)
                      Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                      bmeeksB 1 Reply Last reply Reply Quote 0
                      • bmeeksB
                        bmeeks @Qinn
                        last edited by bmeeks

                        @qinn said in Quick Snort Setup Instructions for New Users:

                        New to Snort I follow this one https://www.youtube.com/watch?v=-GgqYq5-EBg&feature=youtu.be and setup accordingly only one interface eg the WAN.
                        Strange enough I only see one source ip address (LAN) in the Alerts tab. I have 10 subnets, with many users using the internet, what am I overlooking?

                        For instance in PFBlockerNG-develop I am see enough of the IP's of the subnets.

                        Cheers Qinn

                        When you run Snort on the WAN, it sees inbound traffic from the Internet before the NAT rules are unwound. So every packet has the public WAN IP address of your firewall as the destination. Only after NAT is unwound will the actual LAN IP address be present.

                        For this reason I recommend users run Snort on the LAN and not the WAN. When you run it on the LAN, it sees packets after NAT has been unwound so the IP addresses map directly to your LAN hosts.

                        1 Reply Last reply Reply Quote 0
                        • QinnQ
                          Qinn
                          last edited by

                          @bmeeks first thank you for the advice. I have changed it from WAN to WLAN (a private VLAN subnet for an AP) which has internet access and roughly 20 nodes, smartphones, desktops, Sonos etc.
                          In 2 hours time there were 10 alerts => (http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE

                          I have only enabled "Snort will use rules from one of three pre-defined IPS policies in the Snort Subscriber rules" and IPS Policy Selection checked.

                          Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                          Firmware: Latest-stable-pfSense CE (amd64)
                          Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                          bmeeksB 1 Reply Last reply Reply Quote 0
                          • bmeeksB
                            bmeeks @Qinn
                            last edited by

                            @qinn said in Quick Snort Setup Instructions for New Users:

                            @bmeeks first thank you for the advice. I have changed it from WAN to WLAN (a private VLAN subnet for an AP) which has internet access and roughly 20 nodes, smartphones, desktops, Sonos etc.
                            In 2 hours time there were 10 alerts => (http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE

                            I have only enabled "Snort will use rules from one of three pre-defined IPS policies in the Snort Subscriber rules" and IPS Policy Selection checked.

                            The HTTP_INSPECT preprocessor rules will fire frequently and these days are mostly false positives. Most admins disable several of the HTTP_INSPECT rules. Search the IDS/IPS sub-forum here for suggestions on Snort Suppression Lists to find rules that most users suggest either suppressing or disabling.

                            QinnQ 1 Reply Last reply Reply Quote 0
                            • QinnQ
                              Qinn @bmeeks
                              last edited by

                              @bmeeks now I reread my reply, I realize I wasn't clear, I should have emphasized that I only had these ten alerts in 2 hours and that seems rather meager. I would have expected to see loads of alerts, as approximately 20 users (smartphones, desktops, Sonos etc.) are on this subnet.

                              Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                              Firmware: Latest-stable-pfSense CE (amd64)
                              Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                              bmeeksB 1 Reply Last reply Reply Quote 0
                              • bmeeksB
                                bmeeks @Qinn
                                last edited by

                                @qinn, it depends totally on which precise rules are enabled and what the traffic on your network actually consists of. The goal in IDS/IPS is to get no or very few alerts and blocks. That means your network is relatively secure and clients are following the rules ... ☺ .

                                I don't mean that to say you should never get alerts, though. Just that you don't want to be receiving hundreds per hour. Once blocking is enabled that might drive you crazy as an admin. Within the IPS Polices, the Snort team has selected rules that provide security without a ton of false positive alerts.

                                1 Reply Last reply Reply Quote 1
                                • johnpozJ johnpoz referenced this topic on
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.