Re: DOS attacks

[Todd Wease <twease () sourcefire com>]

I should have also mentioned the sfportscan preprocessor which will 
detect distributed portscans.

Todd Wease wrote:
> Hi Kamran,
>
> Land attack is detected in the Snort decoder and teardrop is detected in
> the frag3 preprocessor.  There is also a rule set called dos.rules that
> you can try.  Snort does not detect flooding DoS attacks such as UDP
> flood or TCP SYN flood because the resources required to track these
> would in effect DoS Snort.  Snort typically starts tracking a session
> after it has seen a server response (such as a SYN/ACK).
>
> Not sure about the Nessus scan, but it could depend on your Snort
> configuration and rule set.
>
> Todd
>
> Kamran Shafi wrote:
> > P.S.
> > Is there a specific preprocessor to handle DOS attacks in Snort or it is
> > only done through the Snort rules? In specific, I couldn't find any
> > rules for flooding DOS attacks and the classical DOS attacks like land
> > and teardrop. Do I have to write my own rules to cater for these types
> > of attacks?
> >  
> > Further, I am conducting a full Nessus scan but Snort is only reporting
> > very few alerts (20 odd). Is it normal?
> >
> > -- 
> > Regards
> > Kam
> >
> >
> > ------------------------------------------------------------------------
> >
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by: Microsoft
> > Defy all challenges. Microsoft(R) Visual Studio 2008.
> > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> >
> >
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users