fwsnort-1.6.8-2.mga7.noarch.rpm


Advertisement

Description

fwsnort - Translates Snort rules into equivalent iptables rules

Property Value
Distribution Mageia Cauldron
Repository Mageia Core i586
Package filename fwsnort-1.6.8-2.mga7.noarch.rpm
Package name fwsnort
Package version 1.6.8
Package release 2.mga7
Package architecture noarch
Package type rpm
Category System/Servers
Homepage http://www.cipherdyne.org/fwsnort/
License GPLv2+
Maintainer -
Download size 1.27 MB
Installed size 14.48 MB
fwsnort translates Snort rules into equivalent iptables rules and generates
a Bourne shell script that implements the resulting iptables commands. This
ruleset allows network traffic that exhibits Snort signatures to be logged
and/or dropped by iptables directly without putting any interface into
promiscuous mode or queuing packets from kernel to user space. In addition,
fwsnort (optionally) uses the IPTables::Parse module to parse the iptables
ruleset on the machine to determine which Snort rules are applicable to the
specific iptables policy.  After all, if iptables is blocking all inbound
http traffic from external addresses, it is probably not of much use to try
detecting inbound attacks against against tcp/80. By default fwsnort
generates iptables rules that log Snort sid's with --log-prefix to klogd
where the messages can be analyzed with a log watcher such as logwatch or
psad (see http://www.cipherdyne.org/psad). fwsnort relies on the iptables
string match extension to match Snort content fields in the application portion
of ip traffic. Since Snort rules can contain hex data in content fields,
fwsnort implements a patch against iptables-1.2.7a which adds a
"--hex-string" option which will accept content fields such as
"|0d0a5b52504c5d3030320d0a|". fwsnort bundles the latest rule set from
Emerging Threats (http://www.emergingthreats.net) and also includes all rules
from the Snort-2.3.3 IDS - the final Snort rule set that was released under
the GPL.  fwsnort is able to translate well over 60% of all bundled rules.
For more information about the translation strategy as well as
advantages/disadvantages of the method used by fwsnort to obtain intrusion
detection data, see the README included with the fwsnort sources or browse
to: http://www.cipherdyne.org/fwsnort/

Alternatives

Package Version Architecture Repository
fwsnort-1.6.8-2.mga7.noarch.rpm 1.6.8 noarch Mageia Core
fwsnort - - -

Requires

Name Value
config(fwsnort) == 1.6.8-2.mga7
iptables -
perl >= 0:5.006
perl(AutoLoader) -
perl(Carp) -
perl(Cwd) -
perl(Data::Dumper) -
perl(DynaLoader) -
perl(Exporter) -
perl(File::Copy) -
perl(File::Path) -
perl(File::Temp) -
perl(Getopt::Long) -
perl(IO::Socket) -
perl(NetAddr::IP::InetBase) -
perl(NetAddr::IP::Lite) >= 1.410.0
perl(NetAddr::IP::Util) >= 1.460.0
perl(NetAddr::IP::Util_IS) -
perl(POSIX) -
perl(Socket) -
perl(Sys::Hostname) -
perl(strict) -
perl(vars) -
perl(warnings) -
perl-base >= 2:5.28.0

Provides

Name Value
config(fwsnort) == 1.6.8-2.mga7
fwsnort == 1.6.8-2.mga7
perl(IPTables::Parse) == 1.6.1
perl(NetAddr::IP) == 4.580.0
perl(NetAddr::IP::InetBase) == 0.60.0
perl(NetAddr::IP::Lite) == 1.410.0
perl(NetAddr::IP::Util) == 1.460.0
perl(NetAddr::IP::UtilPP) == 1.800.0
perl(NetAddr::IP::UtilPolluted) -
perl(NetAddr::IP::Util_IS) == 1.0.0

Download

Type URL
Mirror distrib-coffee.ipsl.jussieu.fr
Binary Package fwsnort-1.6.8-2.mga7.noarch.rpm
Source Package fwsnort-1.6.8-2.mga7.src.rpm

Install Howto

  1. Enable Mageia Core repository on Install and Remove Software
  2. Update packages list:
    # urpmi.update -a
  3. Install fwsnort rpm package:
    # urpmi fwsnort

Files

Path
/etc/fwsnort/fwsnort.conf
/etc/fwsnort/snort_rules/VERSION
/etc/fwsnort/snort_rules/attack-responses.rules
/etc/fwsnort/snort_rules/backdoor.rules
/etc/fwsnort/snort_rules/bad-traffic.rules
/etc/fwsnort/snort_rules/chat.rules
/etc/fwsnort/snort_rules/ddos.rules
/etc/fwsnort/snort_rules/deleted.rules
/etc/fwsnort/snort_rules/dns.rules
/etc/fwsnort/snort_rules/dos.rules
/etc/fwsnort/snort_rules/emerging-all.rules
/etc/fwsnort/snort_rules/experimental.rules
/etc/fwsnort/snort_rules/exploit.rules
/etc/fwsnort/snort_rules/finger.rules
/etc/fwsnort/snort_rules/ftp.rules
/etc/fwsnort/snort_rules/icmp-info.rules
/etc/fwsnort/snort_rules/icmp.rules
/etc/fwsnort/snort_rules/imap.rules
/etc/fwsnort/snort_rules/info.rules
/etc/fwsnort/snort_rules/local.rules
/etc/fwsnort/snort_rules/misc.rules
/etc/fwsnort/snort_rules/multimedia.rules
/etc/fwsnort/snort_rules/mysql.rules
/etc/fwsnort/snort_rules/netbios.rules
/etc/fwsnort/snort_rules/nntp.rules
/etc/fwsnort/snort_rules/oracle.rules
/etc/fwsnort/snort_rules/other-ids.rules
/etc/fwsnort/snort_rules/p2p.rules
/etc/fwsnort/snort_rules/policy.rules
/etc/fwsnort/snort_rules/pop2.rules
/etc/fwsnort/snort_rules/pop3.rules
/etc/fwsnort/snort_rules/porn.rules
/etc/fwsnort/snort_rules/rpc.rules
/etc/fwsnort/snort_rules/rservices.rules
/etc/fwsnort/snort_rules/scan.rules
/etc/fwsnort/snort_rules/shellcode.rules
/etc/fwsnort/snort_rules/smtp.rules
/etc/fwsnort/snort_rules/snmp.rules
/etc/fwsnort/snort_rules/sql.rules
/etc/fwsnort/snort_rules/telnet.rules
/etc/fwsnort/snort_rules/tftp.rules
/etc/fwsnort/snort_rules/virus.rules
/etc/fwsnort/snort_rules/web-attacks.rules
/etc/fwsnort/snort_rules/web-cgi.rules
/etc/fwsnort/snort_rules/web-client.rules
/etc/fwsnort/snort_rules/web-coldfusion.rules
/etc/fwsnort/snort_rules/web-frontpage.rules
/etc/fwsnort/snort_rules/web-iis.rules
/etc/fwsnort/snort_rules/web-misc.rules
/etc/fwsnort/snort_rules/web-php.rules
/etc/fwsnort/snort_rules/x11.rules
/etc/logrotate.d/fwsnort
/usr/lib/fwsnort/
/usr/lib/fwsnort/IPTables/Parse.pm
/usr/lib/fwsnort/i386-linux-thread-multi-64int/
/usr/lib/fwsnort/i386-linux-thread-multi-64int/NetAddr/IP.pm
/usr/lib/fwsnort/i386-linux-thread-multi-64int/NetAddr/IP/InetBase.pm
/usr/lib/fwsnort/i386-linux-thread-multi-64int/NetAddr/IP/Lite.pm
/usr/lib/fwsnort/i386-linux-thread-multi-64int/NetAddr/IP/Util.pm
/usr/lib/fwsnort/i386-linux-thread-multi-64int/NetAddr/IP/UtilPP.pm
/usr/lib/fwsnort/i386-linux-thread-multi-64int/NetAddr/IP/Util_IS.pm
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/IPTables/Parse
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/_compV6.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/_compact_v6.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/_splitplan.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/_splitref.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/autosplit.ix
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/coalesce.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/compactref.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/do_prefix.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/hostenum.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/mod_version.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/nprefix.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/prefix.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/re.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/re6.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/short.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/wildcard.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/_inet_ntop.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/_inet_pton.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/_packzeros.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/autosplit.ix
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/inet_any2n.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/inet_n2ad.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/inet_n2dx.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/inet_ntoa.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/ipv6_aton.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/InetBase/ipv6_ntoa.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/Util/autosplit.ix
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/_128x10.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/_128x2.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/_bcd2bin.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/_bcdcheck.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/_bin2bcdn.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/_deadlen.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/_sa128.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/add128.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/addconst.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/autosplit.ix
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/bcd2bin.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/bcdn2bin.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/bcdn2txt.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/bin2bcd.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/bin2bcdn.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/comp128.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/hasbits.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/ipanyto6.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/ipv4to6.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/ipv6to4.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/mask4to6.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/maskanyto6.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/notcontiguous.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/shiftleft.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/simple_pack.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/slowadd128.al
/usr/lib/fwsnort/i386-linux-thread-multi-64int/auto/NetAddr/IP/UtilPP/sub128.al
/usr/sbin/fwsnort
/usr/share/doc/fwsnort/CREDITS
/usr/share/doc/fwsnort/ChangeLog
/usr/share/doc/fwsnort/README
/usr/share/doc/fwsnort/TODO
/usr/share/doc/fwsnort/VERSION
/usr/share/licenses/fwsnort/LICENSE
/usr/share/man/man8/fwsnort.8.xz
/var/log/fwsnort

Changelog

2018-09-20 - umeabot <umeabot> 1.6.8-2.mga7
(not released yet)
+ Revision: 1278393
- Mageia 7 Mass Rebuild
2018-08-16 - daviddavid <daviddavid> 1.6.8-1.mga7
+ Revision: 1251833
- new version: 1.6.8
2017-07-19 - daviddavid <daviddavid> 1.6.7-1.mga7
+ Revision: 1125270
- new version: 1.6.7
2017-02-05 - daviddavid <daviddavid> 1.6.6-1.mga6
+ Revision: 1084880
- new version: 1.6.6
2016-02-20 - umeabot <umeabot> 1.6.5-2.mga6
+ Revision: 972033
- Mageia 6 Mass Rebuild
2015-10-23 - daviddavid <daviddavid> 1.6.5-1.mga6
+ Revision: 894433
- new version: 1.6.5
- move file into '/usr/lib/' dir as it is a noarch package
- fix License
- add from Fedora a logrotate file
- add doc files

See Also

Package Description
fwts-19.03.00-1.mga7.i586.rpm Firmware Test Suite
fwts-efi-runtime-dkms-19.03.00-1.mga7.i586.rpm Firmware Test Suite frontend interface
fwupd-1.2.10-1.mga8.i586.rpm Firmware update daemon
fwupd-tests-1.2.10-1.mga8.noarch.rpm Data files for installed tests
fwupdate-9-5.mga7.i586.rpm Tools to manage UEFI firmware updates
fwupdate-efi-9-5.mga7.i586.rpm UEFI binaries used by libfwup
fxload-2008_10_13-5.mga7.i586.rpm EZ-USB utility program
g15daemon-1.9.5.3-14.mga7.i586.rpm Daemon to control logitech G15 keyboards
gajim-1.1.3-3.mga8.noarch.rpm Jabber Client written in PyGTK
galago-sharp-0.5.0-20.mga7.noarch.rpm Galago Mono bindings
galculator-2.1.4-6.mga7.i586.rpm GTK based calculator
galera-26.4.2-1.mga8.i586.rpm Synchronous multi-master wsrep provider (replication engine)
galette-0.9.2.1-1.mga8.noarch.rpm Online tool to manage membership and fees
galette-plugin-admintools-1.6.2-2.mga7.noarch.rpm Admintools plugin for galette
galette-plugin-fullcard-1.7.2-1.mga7.noarch.rpm Fullcard plugin for galette
Advertisement
Advertisement