There are some tools out there like stick/snot/sneeze that'll do it but
it's getting harder to make Snort dance like this, especially for TCP
traffic. We're doing a lot more protocol analysis these days and most
of the tcp rules depend on the state of the tcp connection and
direction of the traffic, so just blasting packets doesn't work so well
any more . Your best bet is to stick to UDP/ICMP attacks.
The absolute best way to get Snort to generate events is to go out and
grab a bunch of exploits from Packetstorm (or whatever) and run real
attacks. It's more work but it'll do the trick. Alternatively, you
could go through the Snort rule set and strip out the state management
checks like the flow and flowbits keywords and run stick/snot/sneeze.
One other alternative is to grab a big pcap of a hacking event like
DefCon CTF from someplace and run the traffic back through Snort.
-Marty
On Nov 5, 2004, at 12:29 PM, Graeme Connell wrote:
I'm attempting to train a neural network using snort, and I'm having
trouble getting a good number of "bad" packets, IE: those that snort
considers malicious. Since a snort signature is really just a
definition of a subset of all possible packets, it seems like it
should be possible to create a packet that snort considers bad by
filling in packet fields based on a snort signature, then filling the
rest of the packet with random garbage. Does anyone know if this type
of program has already been created, and if so, where could I find it?
Thanks.
--Graeme Connell
-----------------------------------------------------------------------
---
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to
http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to
learn more.
-----------------------------------------------------------------------
---
--
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Discover. Determine. Defend.
roesch@sourcefire.com - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
