Re: Snort Configuration

[Nanda Vardhan <nandu7ninja () gmail com>]

I manually set up the NIC to promiscuous mode and gave all commands in
super user mode but of no use. I still cant sniff the packets of other
devices connected to the network.

And now as u mentioned i tried updating snort but i was end up with  error
mentioned below. I am unable to go any further. stuck up here. help me

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

nanda@nanda-Satellite-L755:~$ sudo apt-get install snort
Reading package lists... Done
Building dependency tree
Reading state information... Done
snort is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Do you want to continue [Y/n]? y
Setting up snort (2.9.2-3ubuntu1) ...
 * Stopping Network Intrusion Detection System
snort                            *  - No running snort instance found
 * Starting Network Intrusion Detection System  snort
[fail]
invoke-rc.d: initscript snort, action "start" failed.
dpkg: error processing snort (--configure):
 subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
 snort
E: Sub-process /usr/bin/dpkg returned an error code (1)


-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------




On Thu, Mar 20, 2014 at 2:20 AM, waldo kitty <wkitty42 () windstream net>wrote:

> On 3/19/2014 7:49 AM, Nanda Vardhan wrote:
> > 1. My snort version is 2.9.2
>
> that's pretty old and unsupported... you need to update to the latest if
> you
> can... this link will tell you the EOL (End Of Life) policy and list the
> supported snort versions... http://www.snort.org/vrt/rules/eol_policy
>
> > 2. public user
>
> that may be one reason... snort needs to be run as root so it can switch
> the NIC
> into promiscuous mode and detect traffic for other devices...
>
> > 3. I dont know what NIC is, as I mentioned am a newbie
>
> NIC : Network Interface Card
>
> > 4.  connected wirelessly through wifi router.
> >
> > - trying to sniff packets through wlan0 interface
> >
> >   My problem is that am unable to sniff the packets of other devices
> connected
> > to my wifi router. when I run snort am getting packets of the device on
> which
> > snort was running. How to configure so that it sniffs the packets of
> other
> > devices connected to the same network which i was sniffing.
>
> there is no real configuration that needs to be done for this... it is
> done as a
> matter of fact because it is the only way it will work, really... i
> suspect that
> your main problem is running snort as a non-root user... the user you are
> using
> has limited permissions and most likely cannot switch the NIC into
> promiscuous
> mode so that it will see all other traffic flowing by it destined for other
> devices...
>
> --
> NOTE: No off-list assistance is given without prior approval.
>        Please keep mailing list traffic on the list unless
>        private contact is specifically requested and granted.
>
>
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!