Re: protocols decoded

[Matt Kettler <mkettler () evi-inc com>]

At 06:10 PM 8/9/2004, jvarlet () aressi fr wrote:
> I would like to know how many protocols snort can decode. Some IDS (like ISS,
> MacAfee,...) can decode more than 100 protocols. I saw that snort decode 3
> (tcp, udp, icmp); but how many protocols from network to application ?

Full decode is AFAIK limited to just those three.

However, there are plugins that do analysis and normalization of several 
other protocols (HTTP, Telnet, etc).

As for the number of decoders being so small, I for one don't really see 
this as a substantial problem.

Snort has TCP decode, and PCRE support. At that point do you really need 
SMTP decoding? It might make rule creation easier, but it doesn't add a 
whole lot of functionality for most protocols. (and snort has http_decode 
to normalize and preprocess http sessions, which definitely ARE complicated 
and worthy of decode).

That said, snort's lack of decoders seems to be at least part of it's 
weaknesses, lack of good rules based on vulnerabilities, not signatures of 
a single exploit script. Snort has many good generalized rules, but it also 
has many that were quickly written from packet dumps and aren't going to 
detect exploits unless made from a particular script. This is an area of 
constant improvement in snort, but it's hardly complete.

(This said, I've not examined the signature databases of many commercial 
products. They could be even worse)


Other counter-points to consider are:

        1) how flexible is the tool in creating rules for protocols with 
no decoder? Can you use regex syntax? multi-part content checks? decode of 
bytes in the data into numeric format and do > or < type comparisons? Just 
because one tool has more decoders than another doesn't make it a better tool.

        2) what's the cost? Snort's a free download. Snort may be the 
ultimate IDS, but it's damn good, and in price/performance it's hard to match.

And of course, take all of these in context of what your needs are. No IDS 
can be the perfect tool for every network. Look at the tools closely to try 
to find one that fits your needs. Snort's probably the best tool for the "I 
analyze attacks and write my own signatures" type user, but it's not well 
suited to the "I want to set it and forget it" type (no IDS is good for 
this, but some are much closer to this than the snort download is).









-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users