IDS mailing list archives
Re: Snort signature packet generator
From: Martin Roesch <roesch () sourcefire com>
Date: Mon, 8 Nov 2004 10:34:12 -0500
There are some tools out there like stick/snot/sneeze that'll do it but it's getting harder to make Snort dance like this, especially for TCP traffic. We're doing a lot more protocol analysis these days and most of the tcp rules depend on the state of the tcp connection and direction of the traffic, so just blasting packets doesn't work so well any more . Your best bet is to stick to UDP/ICMP attacks.
The absolute best way to get Snort to generate events is to go out and grab a bunch of exploits from Packetstorm (or whatever) and run real attacks. It's more work but it'll do the trick. Alternatively, you could go through the Snort rule set and strip out the state management checks like the flow and flowbits keywords and run stick/snot/sneeze. One other alternative is to grab a big pcap of a hacking event like DefCon CTF from someplace and run the traffic back through Snort.
-Marty On Nov 5, 2004, at 12:29 PM, Graeme Connell wrote:
I'm attempting to train a neural network using snort, and I'm having trouble getting a good number of "bad" packets, IE: those that snort considers malicious. Since a snort signature is really just a definition of a subset of all possible packets, it seems like it should be possible to create a packet that snort considers bad by filling in packet fields based on a snort signature, then filling the rest of the packet with random garbage. Does anyone know if this type of program has already been created, and if so, where could I find it? Thanks.--Graeme Connell----------------------------------------------------------------------- ---Test Your IDS Is your IDS deployed correctly?Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. ----------------------------------------------------------------------- ---
-- Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616 Sourcefire - Discover. Determine. Defend. roesch () sourcefire com - http://www.sourcefire.com Snort: Open Source Network IDS - http://www.snort.org -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly?Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------
Current thread:
- Snort signature packet generator Graeme Connell (Nov 08)
- RE: Snort signature packet generator Eric Hines (Nov 09)
- RE: Snort signature packet generator Jeff Dell (Nov 09)
- Re: Snort signature packet generator Dirk Geschke (Nov 09)
- RE: Snort signature packet generator Leandro Reox (Nov 12)
- Re: Snort signature packet generator Martin Roesch (Nov 09)
- Re: Snort signature packet generator Stefano Zanero (Nov 14)
- <Possible follow-ups>
- RE: Snort signature packet generator adam.w.hogan (Nov 09)
- Re: Snort signature packet generator ADT (Nov 12)
- Re: Snort signature packet generator Derek Armstrong (Nov 09)
- RE: Snort signature packet generator Simon and Lori Chang (Nov 12)