Tcp session hijacking

[Meysam Farazmand <farazmand.meisam () gmail com>]

Hi all,

I used "check_session_hijacking" in stream5 preprocessor for session
hijacking attacks detection and launched a mitm attack. But snort did not
detect it. I also checked preprocessor rules for detecting this type of
attack and there was some rules in my ruleset.

Does anyone know how to configure snort to detect session hijacking and
mitm attacks?

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!