Snort mailing list archives
Re: Basic snort setup for processing pcap produces no alerts
From: Egon Kidmose <kidmose () gmail com>
Date: Thu, 27 Mar 2014 10:07:00 +0100
Hi James, Rmkml, Bassant Thanks for your inputs!
"-k none" switch on command
Doesn't improve things. I've also noticed the following in the console output: "Bad Chk Sum: 0 ( 0.000%)" This leads me to believe that my issue isn't related to checksums.
DARPA 1999 for reference dataset
http://www.ll.mit.edu/mission/communications/cyber/CSTcorpora/ideval/data/1999data.html I'm getting some alerts, 2-4 a day for inside and outside respectively, which corresponds reasonably well to what the documentation suggests.
Another check if you have enabled no ethernet (don't remember exactly
what name)
on configure option please? ( New on v2.9.6.0)
I've not been able figure what this config is, but as the DARPA set works I guess it might not be crucial.. It would seem that my config is fine, while my expectation that my trace should trigger alerts is wrong. The good thing is that I got snort running, that bad thing is that it doesn't do what I need, yet :) I'll look into adding more rules, possibly my own. Once again; Thanks! Mvh/BR Egon Kidmose On Wed, Mar 26, 2014 at 12:41 PM, basant subba <basantsubba () gmail com>wrote:
Try running Snort on some standard dataset like DARPA 1999 dataset. If it generates alarm for DARPA dataset then there's nothing wrong with configuration else there might be some misconfiguration. On Wed, Mar 26, 2014 at 4:05 PM, Egon Kidmose <kidmose () gmail com> wrote:Hi all, I am working with snort for the first time, trying to feed in a pcap with known bad traffic and hoping to get out a list of alerts. I use snortrules-snapshot-2960.tar.gz from http://snort.org/snort-rules/without pulledpork as I don't need to get updates. My pcap contains a trace from a controlled environment where I have infected and remote controlled a machine with the fairly old irc bot sdbot, so I expect some reaction from snort, however I get none. My thought is that the absence of alerts follows from one of the following: a) incorrect configuration b) my trace not being "bad enough" for snort to pick it up c) or something else... Is there anyone out there who can help me to fix the configuration, point me to some reference trace that certainly triggers an alert or simply provide possibly useful hints/suggestions/insights? Anything would be greatly appreciated! # command used: ~/git-reps/.../sdbot05b-2014-03-25-1020 $ snort -c ../rules/snortrules-snapshot-2960/etc/snort.conf -r sdbot05b.pcap # output from running snort http://kom.aau.dk/~ekidmose/snort-example/output.txt # snort version: ~/git-reps/.../sdbot05b-2014-03-25-1020 $ snort -V ,,_ -*> Snort! <*- o" )~ Version 2.9.6.0 GRE (Build 47) '''' By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved. Copyright (C) 1998-2013 Sourcefire, Inc., et al. Using libpcap version 1.3.0 Using PCRE version: 8.31 2012-07-06 Using ZLIB version: 1.2.7 # My pcap and the rules with my modifications http://kom.aau.dk/~ekidmose/snort-example.tar.gz http://kom.aau.dk/~ekidmose/snort-example/ Mvh/BR Egon Kidmose ------------------------------------------------------------------------------ Learn Graph Databases - Download FREE O'Reilly Book "Graph Databases" is the definitive new guide to graph databases and their applications. Written by three acclaimed leaders in the field, this first edition is now available. Download your free book today! http://p.sf.net/sfu/13534_NeoTech _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Basic snort setup for processing pcap produces no alerts Egon Kidmose (Mar 26)
- Re: Basic snort setup for processing pcap produces no alerts James Lay (Mar 26)
- Message not available
- Re: Basic snort setup for processing pcap produces no alerts Egon Kidmose (Mar 27)