Snort mailing list archives
Re: How to launch snort as an all time scanner network for a DHCP network scanner
From: "Mark W. Jeanmougin via Snort-users" <snort-users () lists snort org>
Date: Tue, 29 May 2018 11:09:03 -0400
Dorian, At a client site, I deployed bro alongside snort to alert on malicious and just plain "odd" dhcp traffic. It was a great way to detect rogue hosts on the network, rogue dhcp servers, rogue wi-fi access points, things like that. I wouldn't call this "active scanning", it was certainly passive, but this did turn out to be an incredibly effective, and inexpensive, part of their security deployment. MJ On Tue, May 29, 2018 at 10:53 AM Joel Esler (jesler) via Snort-users < snort-users () lists snort org> wrote:
I am not exactly sure what you are asking for, but Snort is not an active scanner. -- *Joel Esler* Sr. Manager Open Source, Design, Web, and Education Talos Group http://www.talosintelligence.com On May 25, 2018, at 3:53 PM, Dorian ROSSE <dorianbrice () hotmail fr> wrote: Dear IT community, How to launch snort as an all time scanner network for a DHCP network scan mode against Virus, Trojan, bad UDP, bad listener, bad program....?(because this server is for Snort ans Nagios) Thank you in advance to answer my ask, Regards. Dorian Rosse. _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette _______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________ Snort-users mailing list Snort-users () lists snort org Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette
Current thread:
- How to launch snort as an all time scanner network for a DHCP network scanner Dorian ROSSE (May 27)
- Re: How to launch snort as an all time scanner network for a DHCP network scanner Joel Esler (jesler) via Snort-users (May 29)
- Re: How to launch snort as an all time scanner network for a DHCP network scanner Mark W. Jeanmougin via Snort-users (May 29)
- Re: How to launch snort as an all time scanner network for a DHCP network scanner Joel Esler (jesler) via Snort-users (May 29)