Streaming Server with Snort

RouterOS General
1

I have been trying to figure out how top configure SNORT with the steaming server option in Mikrotik. I guess Mikrotik supports the TZSP format but I can not figure out how to get snort to accept a UDP stream in that format? I have search for the TZSP format option for SNORT and other such things but have found very little information on this. Can anyone shed some light on this?

Ok I figured out I use ./trafr -s | in some way but I dont see how to make snort listen on standard input.


OK GOT IT.

./trafr -s |/usr/sbin/snort -r -

Now I just need to play more with snort..


Thanks

Tim

Snort IDS ?
Mikrotik Router OS / RouterBoard and Snort IDS/IPS
2

Hi,
I have developed an IDS/IPS system for RouterOS.
It is here : http://sourceforge.net/projects/mt-fw-attack/

You need a linux machine to compile and run it.
It collects syslog messages from your’s routeros device (there are instructions on how to use it) and adds the attackers on an address list which you can use to block them.
:slight_smile:

3

Wow, thank you, I will try.

4

Hi

Does somebody tried this mt-fw-attack package? on which linux distro, can somebody help?

Best

5

Got it!Solved!

6

Hi

Does somebody implement this ids/ips system???

i installed everything and put some rules with remote logging option but nothing happen

is this daemon put attacker ip address dynamically on router??

Best

7

Solved!!

Thanks gkoufoud!

Best

8

help, cann’t see this daemon put attacker ip address on router address list, i can see the attacker ip in the linux syslog.

thanks a lot

9

Solved!!

Thanks gkoufoud!

Best