Re: Snort signature packet generator

[Dirk Geschke <Dirk_Geschke () genua de>]

Hi Graeme,

> I'm attempting to train a neural network using snort, and I'm having 
> trouble getting a good number of "bad" packets, IE: those that snort 
> considers malicious.  Since a snort signature is really just a 
> definition of a subset of all possible packets, it seems like it should 
> be possible to create a packet that snort considers bad by filling in 
> packet fields based on a snort signature, then filling the rest of the 
> packet with random garbage.  Does anyone know if this type of program 
> has already been created, and if so, where could I find it?  Thanks.

fpg, the false-positive generator does exact this. But actually not
all keywords are supported. Especially pcre is difficult to implement.

fpg is part of the Fast Logging Project for snort: FLoP

You can find it at

  http://www.geschke-online.de/FLoP/

The manual page for fpg is online available:

  http://www.geschke-online.de/FLoP/fpg.8.html

But note: For TCP the most alerts will not work as long as stream4
is used (or equivalent the established flag is set). To get all alerts
you should disable stream4 for this case.

Best regards

Dirk

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------