Snort mailing list archives
Re: Going to add functionality for ICS technologies and SCADA protocols
From: Arun Saini <mailarunsaini () gmail com>
Date: Tue, 12 Jul 2016 16:22:08 +0530
yes that i got , still i have two queries , 1) please provide sample rules to capture the traffic as i have generated the traffic but it is not detecting it , do we really need to create the rules set for the same i.e. Modbus /DNP3 2) if i want to create the preprocessor for IEEE 60870 , how should i proceed as i want to make my snort for ICS/SCADA specific only . [image: --] Arun Saini [image: http://]about.me/arun.saini <http://about.me/arun.saini> *Mobile: +91-9890738762* *in.linkedin.com/in/mailarunsaini <http://in.linkedin.com/in/mailarunsaini>* On 12 July 2016 at 16:09, Al Lewis (allewi) <allewi () cisco com> wrote:
Please see the README files for DPN3 and MODBUS that are included with the snort download. The modbus and dnp3 preprocessor examples are also in the default snort.conf . *Albert Lewis* QA SNORT/Sourcefire SOURCE*fire*, Inc. now part of *Cisco* 9780 Patuxent Woods Drive Columbia, MD 21046 Email: allewi () cisco com From: Arun Saini <mailarunsaini () gmail com> Date: Tuesday, July 12, 2016 at 2:25 AM To: 'snort-users' <snort-users () lists sourceforge net> Subject: [Snort-users] Going to add functionality for ICS technologies and SCADA protocols Hi Team, I want to add SCADA protocols traffic detection functionality in my snort engine/configuration , can anyone help me to how to add/start rules and preprocessor addition for the below ??? i have additional wire shark packet capture results for the same traffic and bits , bites and protocol header detailed information ready. SCADA protocols :-DNP3, Modbus, BACNet, ICCP, IEEE 60870 [image: --] Arun Saini [image: http://]about.me/arun.saini <http://about.me/arun.saini> *Mobile: +91-9890738762* *in.linkedin.com/in/mailarunsaini <http://in.linkedin.com/in/mailarunsaini>*
------------------------------------------------------------------------------ What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals which users, apps, and protocols are consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using capacity planning reports.http://sdm.link/zohodev2dev
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Going to add functionality for ICS technologies and SCADA protocols Arun Saini (Jul 11)
- Re: Going to add functionality for ICS technologies and SCADA protocols Al Lewis (allewi) (Jul 12)
- Re: Going to add functionality for ICS technologies and SCADA protocols Arun Saini (Jul 12)
- Re: Going to add functionality for ICS technologies and SCADA protocols Joel Esler (Jul 13)
- Re: Going to add functionality for ICS technologies and SCADA protocols Arun Saini (Jul 12)
- Re: Going to add functionality for ICS technologies and SCADA protocols Al Lewis (allewi) (Jul 12)