Visit Our UNIX and Linux User Community


Snort HTTPS


 
Thread Tools Search this Thread
Special Forums Cybersecurity Snort HTTPS
# 1  
Old 11-21-2012
Snort HTTPS

Is it possible to rule out in alert all HTTPS traffic or rule out all the HTTPS trafic from the alerts on snort ?
# 2  
Old 11-21-2012
I'm confused - please tell us what problem you are trying to solve.
This User Gave Thanks to jim mcnamara For This Post:
# 3  
Old 11-21-2012
ok the situation is i have a IDS ( SourceFire ) is snort based and i have a completly normal snort rule, that looks for a escape character on normal HTTP request and he assumes that the type of request on some of the strings i have on my network are a exploit but in fact is not is just a HTTPS that escape the ASCII (a-f 0-9) in this case the rule looks for %1u content and in fact that character "u" exists in some of the requests in https for security reasons. I would like to say Snort if u see any HTTPS request dont use this rule or edit that rule and put only HTTP not on HTTPS transactions.
# 4  
Old 11-22-2012
Disable the original rule, copy it to rules.local and edit it so it doesn't apply to HTTPS?

Previous Thread | Next Thread

5 More Discussions You Might Find Interesting

1. Homework & Coursework Questions

Error in installation of Snort 2.97.0

Use and complete the template provided. The entire template must be completed. If you don't, your post may be deleted! 1. The problem statement, all variables and given/known data: My system is Redhat 5.6. I want to install snort in my system which requires following dependencies. 1. Libpcap... (8 Replies)
Discussion started by: Ankur Goyal
8 Replies

2. Solaris

Need suggestion:- Failed HTTPS transfer to https://supportfiles.sun.com/curl

Hi Guys, I have recently started reciving below Error message Failed HTTPS transfer to https://supportfiles.sun.com/curl whenever I run /usr/local/bin/sudo /opt/SUNWexplo/bin/explorer -P -q -v from all Servers. Looks like the SSL certificate as Expired. Whenever I type... (4 Replies)
Discussion started by: manalisharmabe
4 Replies

3. Cybersecurity

Snort/NTOP Placement

I have been asked to place 2 (1 NTOP & 1 SNORT) boxes within our network as part of our tool kit for network monitoring and Intrusion detection. Out network is very simplistic and it layed out like this: internet | | Cisco 1811 Router (8x Layer 2 switch ports) ... (0 Replies)
Discussion started by: metallica1973
0 Replies

4. Linux

snort port no

Hi, can anybody know snort port no in linux, (1 Reply)
Discussion started by: manoj.solaris
1 Replies

5. BSD

Snort on openbsd

Im trying to gather some info to set up snort on openbsd 3.2, has anyone out there managed to get it up and running ? My initial attempts seem to be quite below par (4 Replies)
Discussion started by: malcontent
4 Replies

Featured Tech Videos