snortattack

snort_inline 2.8.4.1 statico con nflink

Aggiornata la versione di snort_inline 2.8.4.1 con nflink

http://www.snortattack.org/static/snort_inline_2.8.4.1.nflink.static.gz

Mettere per le regole nuove abilitare DCE/RPC 2 Preprocessor:

preprocessor dcerpc2: \
memcap 102400, events [smb, co, cl]

preprocessor dcerpc2_server: \
default, policy WinXP, \
detect [smb [139,445], tcp 135, udp 135, rpc-over-http-server 593], \
autodetect [tcp 1025:, udp 1025:, rpc-over-http-server 1025:],
smb_max_chain 3

disabilitare : DCE/RPC preprocessor.

Un'attenzione particolare ai preprocessori che in questa versione devono essere attivi e configurati correttamente per poter usare le regole (esempio http).

Stay tuned!

Snort 2.8.5 Flex2 statico

Snortattack team release Snort 2.8.5 compiled with Flex2

http://www.snortattack.org/static/snort-2.8.5.flex2_static.gz

Changelog :

* Ability to specify multiple configurations (snort.conf and everything it includes), bound either by Vlan ID or IP Address. This allows you to run one instance of Snort with multiple snort.conf files, rather than having separate processes. See README.multipleconfigs for details.
* Continued inspection of traffic while reloading a configuration. Add —enable-reload option to your configure script prior to building. See README.reload for details.
* Rate Based Attack Prevention for Connection Attempts, Concurrent Connections, and improved rule/event filtering. See README.filters for details.
* SSH preprocessor
* Performance improvements in various places

look at snort.org for other info.

Stay Tuned!
Snortattack TEAM!

Snort 2.8.5 Flex2 statico

Rilasciato il binario statico Snort 2.8.5 compilato Flex2

http://www.snortattack.org/static/snort-2.8.5.flex2_static.gz

ecco in lingua originale il changelog :

* Ability to specify multiple configurations (snort.conf and everything it includes), bound either by Vlan ID or IP Address. This allows you to run one instance of Snort with multiple snort.conf files, rather than having separate processes. See README.multipleconfigs for details.
* Continued inspection of traffic while reloading a configuration. Add —enable-reload option to your configure script prior to building. See README.reload for details.
* Rate Based Attack Prevention for Connection Attempts, Concurrent Connections, and improved rule/event filtering. See README.filters for details.
* SSH preprocessor
* Performance improvements in various places

fai riferimento a snort.org per le novità introdotte.

Stay Tuned!
Snortattack TEAM!