Snort mailing list archives

Snort only alerting about IP its running on


From: Rahul Bhonsale <rbhonsale () invariant-corp com>
Date: Fri, 26 Jun 2015 15:06:28 +0000

I'm trying to set up a snort IDS from my machine(opensuse 13.1) to monitor the entire network. When I run snort I am 
sniffing all the packets and monitoring all computers on the network, but I am only getting alerts for my machine. I 
want the alert file to alert me about ALL IP's. I also tried including specific IP adressess in HOME_NET and it would 
still only alert me about my opensuse machine.

My snort.conf: HOME_NET 192.168.1.0/24

EXTERNAL_NET !$HOME_NET

output alert_fast: /var/log/snort/fast_alert.txt

I am using pulledpork for my one snort.rules file.

I run snort as so: snort -d -c /etc/snort/snort.conf -vv

also, It might be important information that I do not have eth0 as a network device option.

How can I make snort alert me for all machines/IP's on the network?
------------------------------------------------------------------------------
Monitor 25 network devices or servers for free with OpManager!
OpManager is web-based network management software that monitors 
network devices and physical & virtual servers, alerts via email & sms 
for fault. Monitor 25 devices for free with no restriction. Download now
http://ad.doubleclick.net/ddm/clk/292181274;119417398;o
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!


Current thread: