How to create a SNORT rule and test it.

[Altair8801]

But Hakim, I really didn't like the screencast. I would like to see a higher quality video, and a bigger window for better overview. You may want to try some other screencast software. And remember, knowledge is power, and information wants to be free!

[Altair8801]

Let me clarify. Hakim, your presentation is good, I mean the way you presented it. And really I love the way you speak English. Really! I think you speak very good, and I love that accent. I can really understand what you're saying. Unlike the "aaamericccaaaeeann aeenglish" or the "bryytyysh ynglysh". They eat half the words, don't pronounce them. In comparison your English is easy to understand for everyone, Americans and British included.

[ladserg]

thanks..

[Altair8801]

Is that your standard desktop or your virtual desktop?... what kind of resolution is that?... is that VGA?.... what year was this video created, in 1986?.... the least you could do is upgrade to XGA.... you don't even see the buttons on the task bar, you have to scroll it... oh my god... oh man, I could never work on a "machine" like that...

[pmartinjob]

@Altair8801 I guess what you're not understanding is that 1) He's using virtual machines 2) If you pump up the resolution really high, you can't read or see anything he is doing when it plays back on a YouTube video and 3) He learned a difficult and lucrative skill (which you likely do not also posess) that he's sharing with you for free and you are just complaining about it rather than either being thankful or contributing in any way.

[Altair8801]

@pmartinjob

You got to be kidding me. You're commenting on a 7 months old YouTube comment?! FYI, you can't really tell if someone is using a virtual machine or not, just by looking at some recorded screencast. Two, true you can't see "anything" if you're blind OR very little if you're shortsighted, but the truth is many screencasting wares allow you to zoom in and out as necessary, and yes, you can see if you too have a big screen.

[Altair8801]

@pmartinjob

Three, I don't see how this is a lucrative or even a difficult skill. Or a difficult task I should say, performing a task doesn't prove someone as skillful. Four, yes he is sharing his knowledge with others, and I thank him for that, knowledge is worthless if not shared in fact! Five, I am not complaining about the fact that he is sharing it with us, I complain over the presentation and/or video quality of it. Six, yes I do contribute, I contribute with constructive criticism.

[Altair8801]

@pmartinjob

Seven, what exactly do you contribute with?... Eight, this man is the author of this video, and I'm sure he understood my criticism. If he didn't understand it or if he wanted to object it I'm sure he would have done so, SEVEN MONTHS ago! Here are you criticizing me for criticizing him, 7 months later. It's as if I was criticizing your own work. Why is it so important to you?

[Altair8801]

@pmartinjob

Me not understanding the subject?! Me not contributing with anything to the subject?! Who the hell are you?! You don't fuckin know me! I don't have to prove anything to you. Bye!

[miekmuse1exploit]

good video nice done

[wnliyana]

may i know what kind of attack is this?

[ddos411]

thanks youhakim, you are genius!

[sumi006]

after installing snort by watching ur video i am gettinf an error

Detection: Search-Method = AC-BNFA-Q

ERROR: c:\snort\etc\snort.conf(273) Config option "detection" can only be config

ured once.

Fatal Error, Quitting.. how to remove this??? PLZ HELP

[mehraneon]

a sweet voice can you tel me where do you get rules please

thnx

[youhakim]

See the first snort video, Installing snort on an xp machine.

Thanks.

[jackofsmh]

a great video...

can i ask u..

where i can get the rules like u have..

thanks..

[youhakim]

See the first snort video, Installing snort on an xp machine.

Thank you.

[timtima724]

can u packet this ip for me

he sent me a virus

74.85.13.51

-thanks

[machine3code]

a good video i use snort alot on my network at different points. Signature does have limitations b\c sig. det. requires previous knowledge of an attack to pop up an accurate sig. U can modify network package enough to cause the ids to miss an attack or create false positives which can overwhelm a network. Some firewalls when using a large icmp packet can make the remote host to crash. Sig. is good but it works good with other det. methods of ids.

[38359111]

while incuding rules, why '\' is used before entering website address. however normal incudes hav '/'

[youhakim]

Because I am using snort on Windows, and the snort engine for Windows converts automaticaly '\' to '/'.

[nickrohn93]

great!

[ov35711]

Very good video as always !!

[youhakim]

Thank you "lialia73" for your comment.

The FIN scan (-sF)simpy sets the TCP FIN bit of the flags header on.

the Xmas scan (-sX) sets the FIN, PSH, and URG flags, lighting the packet up like a Christmas tree and thus the name Xmas.

[lialia73]

Thank you Hakim for this video, Can you please explain more what is a xmas and fin scan?

@+

[ComissionX]

I love all your vids ;)