Snort mailing list archives
Re: snort 2972 - not working, need help
From: "Al Lewis (allewi)" <allewi () cisco com>
Date: Tue, 24 Mar 2015 10:12:02 +0000
Hello, The first thing I would check is that you actually see traffic on that interface. How is traffic getting to snort? If you aren’t inline with the traffic then your snort machine needs to be on a tap or have the traffic spanned to it. You can also play a pcap back into snort as a quick test. If you get events from the pcap but not from network traffic then you need to recheck your network setup. Hope this helps. Albert Lewis QA Software Engineer SOURCEfire, Inc. now part of Cisco 9780 Patuxent Woods Drive Columbia, MD 21046 Phone: (office) 443.430.7112 Email: allewi () cisco com From: Eugene Grama [mailto:eugene.grama () gmail com] Sent: Tuesday, March 24, 2015 12:11 AM To: snort-users () lists sourceforge net Subject: [Snort-users] snort 2972 - not working, need help Hell Guys, Hope you are all doing fine. I was able to make snort 2970 work in windows 7, due to some reason, we had freeze this project and we are now again restarting it. I was able to update snort to 2972 without error Then I tried placing this rule in snort.rules file for testing purpose alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"NET - ACTIVITY-YAHOO"; classtype:unknown; sid:1000002; rev:1;) alert icmp $HOME_NET any <> $EXTERNAL_NET any (msg:"PING - ACTIVITY"; classtype:unknown; sid:1000000; rev:1;) Then i run snort -c c:\path\to\dir\snort.conf -l c:\path\to\snort\log -i4 and it run normally ("commencing packet processing" at the end) Tried generating icmp(ping) traffic, but i cannot see any alert generated from my alert log file. Sorry for the grammar, hoping for your usual support -- Thank you and Best regards, Eugene
------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- snort 2972 - not working, need help Eugene Grama (Mar 23)
- Re: snort 2972 - not working, need help Al Lewis (allewi) (Mar 24)