04-12-2002
I have never used snort, but according to the
Snort FAQ:
Quote:
Stream4 is an entirely new preprocessor that preforms two functions:
1) Stateful inspection of TCP sessions
2) TCP stream reassembly
Click on that FAQ link for more info about stream4.
10 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
i really have an issue with the otherwise outstading FreeBSD Handbook when it comes to kernel building. information on the proper steps to take is really confusing. i think that chapters 9 and 21 need to be combined to give a very concise format on how best to deal with kernel building/rebuidling... (1 Reply)
Discussion started by: xyyz
1 Replies
2. UNIX for Dummies Questions & Answers
I want to convert a Microfocus Sequential file to a Line Sequential Variable file. The reason I want to do this is so that I can upload the file from a UNIX box to a PC as a text file. I know that there is a command called "rebuild" that will allow me to convert the files, but I can not get it to... (1 Reply)
Discussion started by: douknownam
1 Replies
3. HP-UX
I thought I would post it again..once a bad drive is replaced need to rebuild it right?? Is disk and drive same? So what command need when the disk gets replaces. When i did diskinfo...and found out the bad disk...and need to replace that..
Thanks if someone could answer this question i have. (1 Reply)
Discussion started by: catwomen
1 Replies
4. HP-UX
Hi....
I newbee to this and wanted help on hpux11 system. Disk is being replaced and need to rebuild and what r the commands I need to perform after the disk is swapped :confused:
Thanks! (1 Reply)
Discussion started by: catwomen
1 Replies
5. Shell Programming and Scripting
Hello UNIX and Oracle Gurus,
After doing an intensive search from different websites, the UNIX forum I am posting this message seeking help..
I am trying to accomplish the following tasks through the shell script:
1. Rebuild indexes on a Table in Oracle
2. Analyze indexes and table... (0 Replies)
Discussion started by: madhunk
0 Replies
6. BSD
hi
Howto rebuild the whole portsystem on freeBSD?
THX (3 Replies)
Discussion started by: ccc
3 Replies
7. Shell Programming and Scripting
Hi
I used this command:
mplayer http://host/axis-cgi/mjpg/video.cgi -user root -passwd root \
-cache 1024 -fps 25.0 -nosound -vc ffh264 \
-demuxer 3 -dumpstream -dumpfile output.avi It's ok but...
Video Playing is very fast! Why? Is it a synch problem?
What parameter I have to use for... (1 Reply)
Discussion started by: takeo.kikuta
1 Replies
8. UNIX for Dummies Questions & Answers
hi,
system operation: unix sco 3.2.4
Kernel not rebuild, do not remove or update tcp/ip e3H0 driver.
messages:
cat:cannot open../sdevice.d/5
line:5.1 32 -1
fatal error:mdevice:wrong number of fields
idmaster:device do not exist in therefore can not be update
idinstall: cannot... (0 Replies)
Discussion started by: milen
0 Replies
9. Linux
hi to all I wanted to edit a enigma2 image to my box ..
the image is root.img ..
Analysed then I have the picture and I have this:
parted root.img
WARNING: You are not superuser. Watch out for permissions.
GNU Parted 2.2
Using /home/soft/Bureau/enigma2/root.img
Welcome to GNU Parted! Type... (3 Replies)
Discussion started by: soft
3 Replies
10. Solaris
I have problem with oracle solaris 10 running on oracle sparc T4-2 server.
Os information: 5.10 Generic_150400-03 sun4v sparc sun4v
Output from tcpstat.d script
TCP bytes: out outRetrans in inDup inUnorder
6833763 7300 98884 0... (2 Replies)
Discussion started by: insatiable1610
2 Replies
LEARN ABOUT DEBIAN
prads2snort
PRADS2SNORT(1) networking PRADS2SNORT(1)
NAME
prads2snort - Snort autotuning of Frag3 and Stream5
SYNOPSIS
prads2snort -i /var/log/prads-asset.log -o /etc/snort/host_attributes.xml -d linux -v
DESCRIPTION
PRADS is a Passive Real-time Asset Detection System.
It passively listen to network traffic and gathers information on hosts and services it sees on the network. This information can be used
to map your network, letting you know what services and hosts are alive/used, or can be used together with your favorite IDS/IPS setup for
"event to host/service" correlation.
Gathering info about your hosts in real-time, will also let you detect assets that are just connected to the network for a short period of
time, where a active network scan (nmap etc.) would take long time, and not common to run continually, hence missing the asset.
The initial goal of implementing PRADS, was to make the host_attribute_table.xml for Snort (automatically).
PRADS2SNORT is the tool that does this!
OPTIONS
-i,--infile <file>
file to feed prads2snort.pl
-o,--outfile <file>
file to write host_attribute data to (host_attribute.xml)
-d,--default <os>
set Default OS if unknown (linux,bsd,macos,windows)
-v, --verbose
prints out OS, frag, stream and confidence of asset
-h, --help
this help message
--version
show prads2snort.pl version
PROBLEMS
1. Better mapping of less used apps to their correct snort attributes or drop them.
SEE ALSO
o PRADS <http://prads.projects.linpro.no/>
o p0f <http://lcamtuf.coredump.cx/p0f.shtml>
o PADS <http://passive.sourceforge.net/>
o Snort <http://snort.org>
o Sguil <http://sguil.net>
o Hogger <http://code.google.com/p/hogger/>
BUGS
Report bugs here:
o http://github.com/gamelinux/prads/issues
For general questions:
o http://projects.linpro.no/mailman/listinfo/prads-devel
o http://projects.linpro.no/mailman/listinfo/prads-users
AUTHOR
edwardfjellskaal@gmail.com
COPYRIGHT
GPL
0.2 2010-06-21 PRADS2SNORT(1)