How to create a SNORT rule and test it.

This video is about creating a SNORT rule and test it.
The rule we will log an alert every time someone sends a packet with the string "www.youtube.com" in it.

Category:

Howto & Style

Tags:

• Snort
• rule
• Nmap
• FYN
• XMAS
• scan

[mehraneon]

a sweet voice can you tel me where do you get rules please

thnx

[youhakim]

See the first snort video, Installing snort on an xp machine.

Thanks.

[jackofsmh]

a great video...

can i ask u..

where i can get the rules like u have..

thanks..

[youhakim]

See the first snort video, Installing snort on an xp machine.

Thank you.

[38359111]

while incuding rules, why '\' is used before entering website address. however normal incudes hav '/'

[youhakim]

Because I am using snort on Windows, and the snort engine for Windows converts automaticaly '\' to '/'.

[Altair8801]

But Hakim, I really didn't like the screencast. I would like to see a higher quality video, and a bigger window for better overview. You may want to try some other screencast software. And remember, knowledge is power, and information wants to be free!

[Altair8801]

Let me clarify. Hakim, your presentation is good, I mean the way you presented it. And really I love the way you speak English. Really! I think you speak very good, and I love that accent. I can really understand what you're saying. Unlike the "aaamericccaaaeeann aeenglish" or the "bryytyysh ynglysh". They eat half the words, don't pronounce them. In comparison your English is easy to understand for everyone, Americans and British included.

[Altair8801]

@pmartinjob

Me not understanding the subject?! Me not contributing with anything to the subject?! Who the hell are you?! You don't fuckin know me! I don't have to prove anything to you. Bye!

[Altair8801]

@pmartinjob

Seven, what exactly do you contribute with?... Eight, this man is the author of this video, and I'm sure he understood my criticism. If he didn't understand it or if he wanted to object it I'm sure he would have done so, SEVEN MONTHS ago! Here are you criticizing me for criticizing him, 7 months later. It's as if I was criticizing your own work. Why is it so important to you?

[Altair8801]

@pmartinjob

Three, I don't see how this is a lucrative or even a difficult skill. Or a difficult task I should say, performing a task doesn't prove someone as skillful. Four, yes he is sharing his knowledge with others, and I thank him for that, knowledge is worthless if not shared in fact! Five, I am not complaining about the fact that he is sharing it with us, I complain over the presentation and/or video quality of it. Six, yes I do contribute, I contribute with constructive criticism.

[Altair8801]

@pmartinjob

You got to be kidding me. You're commenting on a 7 months old YouTube comment?! FYI, you can't really tell if someone is using a virtual machine or not, just by looking at some recorded screencast. Two, true you can't see "anything" if you're blind OR very little if you're shortsighted, but the truth is many screencasting wares allow you to zoom in and out as necessary, and yes, you can see if you too have a big screen.

[pmartinjob]

@Altair8801 I guess what you're not understanding is that 1) He's using virtual machines 2) If you pump up the resolution really high, you can't read or see anything he is doing when it plays back on a YouTube video and 3) He learned a difficult and lucrative skill (which you likely do not also posess) that he's sharing with you for free and you are just complaining about it rather than either being thankful or contributing in any way.

[ladserg]

thanks..

[Altair8801]

Is that your standard desktop or your virtual desktop?... what kind of resolution is that?... is that VGA?.... what year was this video created, in 1986?.... the least you could do is upgrade to XGA.... you don't even see the buttons on the task bar, you have to scroll it... oh my god... oh man, I could never work on a "machine" like that...

[miekmuse1exploit]

good video nice done