4 ms·
Is Snort useful at all on a home network level? E.g. for detecting if some insecure embedded device on the network has been hacked and is spamming all the other
by wswope 4y ago
Is Snort useful at all on a home network level? E.g. for detecting if some insecure embedded device on the network has been hacked and is spamming all the other devices with spray-and-prays?
If not, is there a lighter IDS that would be? Curious to know what the SOTA options are for non-enterprise network security.
- annoyingnoob 4y agoThe thing with Snort (and others like it like Suricata) is that they produce a lot of false positives. You end up with a process of constant tuning of the filters and the filters update/change over time so that process never ends. Maybe its not as noisy in a smaller/home environment but you'll still be going through the alerts. Then when you do get an alert that looks interesting it might take you a lot of time to understand what it means and if it is real or matches the pattern for some other reason. While you may learn things, and you can block things Snort finds to prevent issues before they happen, you'll have some work to do. Some are up for that work and some are not. I've had IDS systems show me things I did not know about. I've never had one save my bacon. IDS is one of those 'part of this complete breakfast' things that doesn't stand alone well but needs to be part of a security solution/approach.
- viraptor 4y agoIt's not as useful this decade due to everything being tunneled over https anyway and it requires you to actually analyse the results. So... I'd say it's not useful for home at all, unless your goal is too learn.
- jstarfish 4y agoIt can still surprise you. A lot of CDNs transfer media over plain HTTP.
- discardedrefuse 4y agoAren't CDN's usually caching legit data though?
- hnlmorg 4y agoCDNs caches will only be as legit as the customers using them. And since moderating content at scale is a hard problem, one cannot assume all CDN data is legit.
- spydum 4y agoFor what it's worth, opnsense has suratica as a service, I've spent a good amount of time configuring it and setting up alerting on drops. The only thing it's ever alerted me to is a few malicious domains (malvertising) and my scanner making calls to Google chat (surprisingly cloud print looks a lot like gchat?). But it happily updates it's ruleset daily, and consumes some 10-20% cpu power from my Intel c2d 3.2ghz cpu. One of these days it might pay off?
- AviationAtom 4y agoMore specifically, OPNSense gives you the ET Pro ruleset for free, from Cisco Talos, which normally runs $800+/yr. It does require opting into reporting firewall logging data though.
- FreakLegion 4y agoNB: ET Pro is from Proofpoint.
- AviationAtom 4y agoDoh. You are right. Mixed the companies up.