fwsnort-1.6.3-5.mga5.i586.rpm


Advertisement

Description

fwsnort - Fwsnort translates Snort rules into equivalent iptables rules

Property Value
Distribution Mageia 5.1
Repository Mageia Core i586
Package name fwsnort
Package version 1.6.3
Package release 5.mga5
Package architecture i586
Package type rpm
Installed size 7.97 MB
Download size 749.98 KB
Official Mirror distrib-coffee.ipsl.jussieu.fr
fwsnort translates Snort rules into equivalent iptables rules and generates
a Bourne shell script that implements the resulting iptables commands. This
ruleset allows network traffic that exhibits Snort signatures to be logged
and/or dropped by iptables directly without putting any interface into
promiscuous mode or queuing packets from kernel to user space. In addition,
fwsnort (optionally) uses the IPTables::Parse module to parse the iptables
ruleset on the machine to determine which Snort rules are applicable to the
specific iptables policy.  After all, if iptables is blocking all inbound
http traffic from external addresses, it is probably not of much use to try
detecting inbound attacks against against tcp/80. By default fwsnort
generates iptables rules that log Snort sid's with --log-prefix to klogd
where the messages can be analyzed with a log watcher such as logwatch or
psad (see http://www.cipherdyne.org/psad). fwsnort relies on the iptables
string match extension to match Snort content fields in the application portion
of ip traffic. Since Snort rules can contain hex data in content fields,
fwsnort implements a patch against iptables-1.2.7a which adds a
"--hex-string" option which will accept content fields such as
"|0d0a5b52504c5d3030320d0a|". fwsnort bundles the latest rule set from
Emerging Threats (http://www.emergingthreats.net) and also includes all rules
from the Snort-2.3.3 IDS - the final Snort rule set that was released under
the GPL.  fwsnort is able to translate well over 60% of all bundled rules.
For more information about the translation strategy as well as
advantages/disadvantages of the method used by fwsnort to obtain intrusion
detection data, see the README included with the fwsnort sources or browse
to: http://www.cipherdyne.org/fwsnort/

Alternatives

Package Version Architecture Repository
fwsnort-1.6.3-5.mga5.x86_64.rpm 1.6.3 x86_64 Mageia Core
fwsnort - - -

Requires

Name Value
config(fwsnort) == 1.6.3-5.mga5
iptables -
libperl.so -
perl >= 0:5.006
perl(AutoLoader) -
perl(Carp) -
perl(Cwd) -
perl(Data::Dumper) -
perl(DynaLoader) -
perl(Exporter) -
perl(File::Copy) -
perl(File::Path) -
perl(Getopt::Long) -
perl(IO::Socket) -
perl(NetAddr::IP::InetBase) -
perl(NetAddr::IP::Lite) >= 1.410.0
perl(NetAddr::IP::Util) -
perl(NetAddr::IP::Util) >= 1.460.0
perl(NetAddr::IP::Util_IS) -
perl(POSIX) -
perl(Socket) -
perl(Sys::Hostname) -
perl(strict) -
perl(vars) -
perl(warnings) -
perl-base >= 2:5.20.1
perlapi-5.20.1 -

Provides

Name Value
config(fwsnort) == 1.6.3-5.mga5
fwsnort == 1.6.3-5.mga5
fwsnort(x86-32) == 1.6.3-5.mga5
perl(IPTables::Parse) == 1.100.0
perl(NetAddr::IP) == 4.580.0
perl(NetAddr::IP::InetBase) == 0.60.0
perl(NetAddr::IP::Lite) == 1.410.0
perl(NetAddr::IP::Util) == 1.460.0
perl(NetAddr::IP::UtilPP) == 1.800.0
perl(NetAddr::IP::UtilPolluted) -
perl(NetAddr::IP::Util_IS) == 1.0.0

Download

Type URL
Binary Package fwsnort-1.6.3-5.mga5.i586.rpm
Source Package fwsnort-1.6.3-5.mga5.src.rpm

Install Howto

  1. Enable Mageia Core repository on Install and Remove Software
  2. Update packages list:
    # urpmi.update -a
  3. Install fwsnort rpm package:
    # urpmi fwsnort

Files

Path
/etc/fwsnort/fwsnort.conf
/etc/fwsnort/snort_rules/VERSION
/etc/fwsnort/snort_rules/attack-responses.rules
/etc/fwsnort/snort_rules/backdoor.rules
/etc/fwsnort/snort_rules/bad-traffic.rules
/etc/fwsnort/snort_rules/chat.rules
/etc/fwsnort/snort_rules/ddos.rules
/etc/fwsnort/snort_rules/deleted.rules
/etc/fwsnort/snort_rules/dns.rules
/etc/fwsnort/snort_rules/dos.rules
/etc/fwsnort/snort_rules/emerging-all.rules
/etc/fwsnort/snort_rules/experimental.rules
/etc/fwsnort/snort_rules/exploit.rules
/etc/fwsnort/snort_rules/finger.rules
/etc/fwsnort/snort_rules/ftp.rules
/etc/fwsnort/snort_rules/icmp-info.rules
/etc/fwsnort/snort_rules/icmp.rules
/etc/fwsnort/snort_rules/imap.rules
/etc/fwsnort/snort_rules/info.rules
/etc/fwsnort/snort_rules/local.rules
/etc/fwsnort/snort_rules/misc.rules
/etc/fwsnort/snort_rules/multimedia.rules
/etc/fwsnort/snort_rules/mysql.rules
/etc/fwsnort/snort_rules/netbios.rules
/etc/fwsnort/snort_rules/nntp.rules
/etc/fwsnort/snort_rules/oracle.rules
/etc/fwsnort/snort_rules/other-ids.rules
/etc/fwsnort/snort_rules/p2p.rules
/etc/fwsnort/snort_rules/policy.rules
/etc/fwsnort/snort_rules/pop2.rules
/etc/fwsnort/snort_rules/pop3.rules
/etc/fwsnort/snort_rules/porn.rules
/etc/fwsnort/snort_rules/rpc.rules
/etc/fwsnort/snort_rules/rservices.rules
/etc/fwsnort/snort_rules/scan.rules
/etc/fwsnort/snort_rules/shellcode.rules
/etc/fwsnort/snort_rules/smtp.rules
/etc/fwsnort/snort_rules/snmp.rules
/etc/fwsnort/snort_rules/sql.rules
/etc/fwsnort/snort_rules/telnet.rules
/etc/fwsnort/snort_rules/tftp.rules
/etc/fwsnort/snort_rules/virus.rules
/etc/fwsnort/snort_rules/web-attacks.rules
/etc/fwsnort/snort_rules/web-cgi.rules
/etc/fwsnort/snort_rules/web-client.rules
/etc/fwsnort/snort_rules/web-coldfusion.rules
/etc/fwsnort/snort_rules/web-frontpage.rules
/etc/fwsnort/snort_rules/web-iis.rules
/etc/fwsnort/snort_rules/web-misc.rules
/etc/fwsnort/snort_rules/web-php.rules
/etc/fwsnort/snort_rules/x11.rules
/usr/lib/fwsnort/
/usr/lib/fwsnort/IPTables/Parse.pm
/usr/lib/fwsnort/i386-linux-thread-multi/
/usr/lib/fwsnort/i386-linux-thread-multi/NetAddr/IP.pm
/usr/lib/fwsnort/i386-linux-thread-multi/NetAddr/IP/InetBase.pm
/usr/lib/fwsnort/i386-linux-thread-multi/NetAddr/IP/Lite.pm
/usr/lib/fwsnort/i386-linux-thread-multi/NetAddr/IP/Util.pm
/usr/lib/fwsnort/i386-linux-thread-multi/NetAddr/IP/UtilPP.pm
/usr/lib/fwsnort/i386-linux-thread-multi/NetAddr/IP/Util_IS.pm
/usr/lib/fwsnort/i386-linux-thread-multi/auto/
/usr/lib/fwsnort/i386-linux-thread-multi/auto/IPTables/Parse
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/_compV6.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/_compact_v6.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/_splitplan.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/_splitref.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/autosplit.ix
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/coalesce.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/compactref.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/do_prefix.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/hostenum.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/mod_version.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/nprefix.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/prefix.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/re.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/re6.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/short.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/wildcard.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/_inet_ntop.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/_inet_pton.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/_packzeros.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/autosplit.ix
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/inet_any2n.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/inet_n2ad.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/inet_n2dx.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/inet_ntoa.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/ipv6_aton.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/InetBase/ipv6_ntoa.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/Util/autosplit.ix
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/_128x10.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/_128x2.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/_bcd2bin.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/_bcdcheck.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/_bin2bcdn.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/_deadlen.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/_sa128.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/add128.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/addconst.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/autosplit.ix
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/bcd2bin.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/bcdn2bin.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/bcdn2txt.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/bin2bcd.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/bin2bcdn.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/comp128.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/hasbits.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/ipanyto6.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/ipv4to6.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/ipv6to4.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/mask4to6.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/maskanyto6.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/notcontiguous.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/shiftleft.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/simple_pack.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/slowadd128.al
/usr/lib/fwsnort/i386-linux-thread-multi/auto/NetAddr/IP/UtilPP/sub128.al
/usr/sbin/fwsnort
/usr/share/man/man8/fwsnort.8.xz
/var/log/fwsnort

Changelog

2014-10-15 - umeabot <umeabot> 1.6.3-5.mga5
+ Revision: 749391
- Second Mageia 5 Mass Rebuild
2014-09-16 - umeabot <umeabot> 1.6.3-4.mga5
+ Revision: 679390
- Mageia 5 Mass Rebuild
2014-06-03 - pterjan <pterjan> 1.6.3-3.mga5
+ Revision: 630770
- Rebuild for perl 5.20
2013-10-21 - umeabot <umeabot> 1.6.3-2.mga4
+ Revision: 541065
- Mageia 4 Mass Rebuild
2013-10-11 - dlucio <dlucio> 1.6.3-1.mga4
+ Revision: 495018
- add perl-devel as BR
- some SPEC fixes
- imported package fwsnort
2012-12-21 - Michael Rash <mbr@cipherydne.org>
- fwsnort-1.6.3 release
2012-04-28 - Michael Rash <mbr@cipherydne.org>
- Updated to use the NetAddr::IP module for all IP/subnet calculations
- fwsnort-1.6.2 release

See Also

Package Description
fwts-15.01.00-2.mga5.i586.rpm Firmware Test Suite
fwts-efi-runtime-dkms-15.01.00-2.mga5.i586.rpm Firmware Test Suite frontend interface
fxload-2008_10_13-3.mga5.i586.rpm EZ-USB utility program
g15daemon-1.9.5.3-11.mga5.i586.rpm Daemon to control logitech G15 keyboards
gajim-0.16-0.beta1.4.mga5.i586.rpm Jabber Client written in PyGTK
galago-sharp-0.5.0-18.mga5.noarch.rpm Galago Mono bindings
galculator-2.1.3-3.mga5.i586.rpm GTK based calculator
galette-0.8.1-1.mga5.noarch.rpm Online tool to manage membership and fees
galette-plugin-admintools-1.5-2.mga5.noarch.rpm Admintools plugin for galette
galette-plugin-fullcard-1.5-2.mga5.noarch.rpm Fullcard plugin for galette
galois-0.3-3.mga5.i586.rpm Extended falling blocks game with many different geometries
gambas3-devel-3.6.2-4.mga5.i586.rpm The Gambas development package
gambas3-examples-3.6.2-4.mga5.noarch.rpm The Gambas examples
gambas3-gb-args-3.6.2-4.mga5.i586.rpm The Gambas args component
gambas3-gb-cairo-3.6.2-4.mga5.i586.rpm The Gambas Cairo component
Advertisement
Advertisement