Snort mailing list archives
(no subject)
From: cnuddep () rogers com
Date: Tue, 25 Oct 2011 12:23:06 -0700 (PDT)
greetings, I have recently installed snort and barnyard2 and BASE on Debian Squeeze as per the Debian installation guide by Jason Weir on the snort website. Everything was working as expected until I enabled the arpspoof preprocessor by placing the following line in my snort.conf file (values changed to protect the innocent) preprocessor arpspoof_detect_host: 10.0.0.1 aa:bb:cc:dd:ee:ff and restarted snort and barnyard. I then launched an arpsoof attack on my network using ettercap. I believe snort is detecting the attack but I am now getting the following errors when I look in BASE: /var/www/base/includes/base_cache.inc.php:776: ERROR: 45 alerts have NOT found their way into acid_event with sid = 1 followed by the 45 alerts which look like this: /var/www/base/includes/base_cache.inc.php:521: ERROR: Alert "1 - 42884" could NOT be found in acid_event. This is no doubt a misconfiguration on my end somewhere. From what I can glean by googling barnyard is not properly writing the events to the snort database. Any advice \ assitance on how I can troubleshoot this or better yet get BASE to actually display the arpspoof attack. Thanks in Advance ------------------------------------------------------------------------------ The demand for IT networking professionals continues to grow, and the demand for specialized networking skills is growing even more rapidly. Take a complimentary Learning@Cisco Self-Assessment and learn about Cisco certifications, training, and career opportunities. http://p.sf.net/sfu/cisco-dev2dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- (no subject) cnuddep (Oct 25)
- <Possible follow-ups>
- (no subject) Daugherty Bryan (Dec 04)
- Re: (no subject) Joel Esler (Dec 05)