Snort mailing list archives
Re: MySQL support for Snort 2.9.4
From: Kaya Saman <kayasaman () gmail com>
Date: Tue, 11 Dec 2012 21:26:55 +0000
On 12/11/2012 07:11 PM, Joel Esler wrote:
You aren't generating any alerts because of:On Dec 11, 2012, at 2:06 PM, Kaya Saman <kayasaman () gmail com <mailto:kayasaman () gmail com>> wrote:Bad Chk Sum: 9421212 ( 50.311%)Try adding -k none to your Snort command line and see if you get anything logged that way.Action Stats: Alerts: 0 ( 0.000%) Logged: 0 ( 0.000%) Passed: 0 ( 0.000%)See, nothing alerted. Also,you might want to use PulledPork to manage your ruleset, as it looks like you have a bunch of unresolved flowbit issues.-- *Joel Esler* Senior Research Engineer, VRT OpenSource Community Manager Sourcefire
Thanks Joel,I used PulledPork but it didn't get any of the *.rules files that are in the tar.gz file. I manually added them in then ran PP again out of which I got:
Reading rules... Reading rules... Reading rules... Setting Flowbit State.... Enabled 23 flowbits Enabled 1 flowbits Done Writing /etc/snort/rules/snort.rules.... Done Writing /etc/snort/rules/so_rules.rules.... Done Generating sid-msg.map.... Done Writing /etc/snort/sid-msg.map.... Done Writing /var/log/sid_changes.log.... Done Rule Stats.... New:-------0 Deleted:---0 Enabled Rules:----16879 Dropped Rules:----0 Disabled Rules:---14849 Total Rules:------31728 Done I still get the flow bit errors as PP from above only enabled 24.In the log file I noticed that I got a bunch of "unkown message" entries so I don't know if that's got anything to do with it?
Using the -k none option as suggested previously I don't get any more 'Bad chck sum' errors but I still don't get anything logged either?
Previously when I used version 2.8.6 with the Emerging Threats ruleset even when run for a few seconds Base would just spike with occurrences, mainly for p2p icmp packets.
Basically it's still not working :-( Regards, Kaya
------------------------------------------------------------------------------ LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and focus on delivering more value-add services Discover what IT Professionals Know. Rescue delivers http://p.sf.net/sfu/logmein_12329d2d
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Re: MySQL support for Snort 2.9.4, (continued)
- Re: MySQL support for Snort 2.9.4 Jeremy Hoel (Dec 10)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 10)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 11)
- Re: MySQL support for Snort 2.9.4 Jeremy Hoel (Dec 11)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 11)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 11)
- Re: MySQL support for Snort 2.9.4 Joel Esler (Dec 11)
- Re: MySQL support for Snort 2.9.4 JJC (Dec 11)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 11)
- Re: MySQL support for Snort 2.9.4 Joel Esler (Dec 11)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 11)
- Re: MySQL support for Snort 2.9.4 Joel Esler (Dec 11)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 11)
- Re: MySQL support for Snort 2.9.4 Joel Esler (Dec 11)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 11)
- Re: MySQL support for Snort 2.9.4 waldo kitty (Dec 12)
- Re: MySQL support for Snort 2.9.4 Russ Combs (Dec 12)
- Re: MySQL support for Snort 2.9.4 waldo kitty (Dec 12)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 12)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 11)
- Re: MySQL support for Snort 2.9.4 Kaya Saman (Dec 11)