Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

How about DOS rule of Snort?

Posted on 2009-07-15
6
Medium Priority
?
1,006 Views
Last Modified: 2013-11-29
I install ok Snort + IDSCenter + Winpcap
OS: w2003

Snort run well, but I have not rule for DOS HTTP
my server run IIS
I 'attack' DOS by sending 1000 query/s to home page, but Snort not recorgnize DOS

What about DOS rules for snort ?

Thanks!
0
Comment
Question by:sunwsposelr60068
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
6 Comments
 
LVL 7

Expert Comment

by:Phateon
ID: 24869768
This is an old .conf file, but you might try it - http://www.0xdeadbeef.info/conf/snort.conf.190
0
 

Author Comment

by:sunwsposelr60068
ID: 24875505
I tried, not success, because have not RULE files, only configfile?
0
 
LVL 7

Expert Comment

by:Phateon
ID: 24877346
Yes. It is a config file.
0
 

Author Comment

by:sunwsposelr60068
ID: 24877715
but how about rules to recorgnize DOS HTTP?
0
 
LVL 7

Accepted Solution

by:
Phateon earned 1000 total points
ID: 24877738
From the .conf file:
#########################################################
# Section #1 (Variables): Service ports
#
# This allows Snort to look for attacks directed to a
# specific application only on the ports that it runs on.
# This also improves overall performance of Snort.
#
# Ports you run Web servers on
var HTTP_PORTS 80
# Ports you want to look for shellcode on.
var SHELLCODE_PORTS !$HTTP_PORTS
# Ports you run Oracle servers on
var ORACLE_PORTS 1521

#########################################################
# Section #1 (Variables): Service ports
#
# This allows Snort to look for attacks directed to a
# specific application only on the ports that it runs on.
# This also improves overall performance of Snort.
#
# Ports you run Web servers on
var HTTP_PORTS 80
# Ports you want to look for shellcode on.
var SHELLCODE_PORTS !$HTTP_PORTS
# Ports you run Oracle servers on
var ORACLE_PORTS 1521

#########################################################
# Section #2 (Preprocessors): stream4
#
# Stateful inspection and stream reassembly for Snort.
# This preprocessor defeats stick/snot attacks against
# TCP rules and can statefully detect various portscan
# flavours, TCP fingerprinting, and more (see original
# snort.conf for further details). You can safely turn
# off "detect_scans" if you feel it's too noisy.
#
preprocessor stream4: detect_scans, disable_evasion_alerts
preprocessor stream4_reassemble


#########################################################
# Section #2 (Preprocessors): http_decode
#
# HTTP traffic normalizer. This preprocessor normalizes
# HTTP requests by converting any %XX character to his
# ASCII equivalent. Now supports unicode, iis_alt_unicode,
# double_encode, iis_flip_slash and full_whitespace
# (see original snort.conf for further details).
#
preprocessor http_decode: 80 unicode iis_alt_unicode double_encode iis_flip_slash full_whitespace
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Ransomware, the malware that locks down its victim’s files until they pay up, has always been a frustrating issue to deal with. However, a recent mobile ransomware will make the issue a little more personal… by sharing the victim’s mobile browsing h…
In this article, WatchGuard's Director of Security Strategy and Research Teri Radichel, takes a look at insider threats, the risk they can pose to your organization, and the best ways to defend against them.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question