RE: Snort signature packet generator

["Leandro Reox" <lmet5on () fibertel com ar>]

Hi Graeme.

We use this tool to test ids like ISS Server Sensor and other products,
and works great, its idswakeup, you can obtain it from here :

http://www.hsc.fr/ressources/outils/idswakeup/index.html.en

Cheers !

-----Original Message-----
From: Dirk Geschke [mailto:Dirk_Geschke () genua de] 
Sent: Lunes, 08 de Noviembre de 2004 01:38 p.m.
To: Graeme Connell
Cc: focus-ids () securityfocus com
Subject: Re: Snort signature packet generator

Hi Graeme,

> I'm attempting to train a neural network using snort, and I'm having 
> trouble getting a good number of "bad" packets, IE: those that snort 
> considers malicious.  Since a snort signature is really just a 
> definition of a subset of all possible packets, it seems like it
should 
> be possible to create a packet that snort considers bad by filling in 
> packet fields based on a snort signature, then filling the rest of the

> packet with random garbage.  Does anyone know if this type of program 
> has already been created, and if so, where could I find it?  Thanks.

fpg, the false-positive generator does exact this. But actually not
all keywords are supported. Especially pcre is difficult to implement.

fpg is part of the Fast Logging Project for snort: FLoP

You can find it at

  http://www.geschke-online.de/FLoP/

The manual page for fpg is online available:

  http://www.geschke-online.de/FLoP/fpg.8.html

But note: For TCP the most alerts will not work as long as stream4
is used (or equivalent the established flag is set). To get all alerts
you should disable stream4 for this case.

Best regards

Dirk

------------------------------------------------------------------------
--
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------
--

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.788 / Virus Database: 533 - Release Date: 01/11/2004
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.788 / Virus Database: 533 - Release Date: 01/11/2004
 


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------