Snort mailing list archives
Snort only alerting about IP its running on
From: Rahul Bhonsale <rbhonsale () invariant-corp com>
Date: Fri, 26 Jun 2015 15:06:28 +0000
I'm trying to set up a snort IDS from my machine(opensuse 13.1) to monitor the entire network. When I run snort I am sniffing all the packets and monitoring all computers on the network, but I am only getting alerts for my machine. I want the alert file to alert me about ALL IP's. I also tried including specific IP adressess in HOME_NET and it would still only alert me about my opensuse machine. My snort.conf: HOME_NET 192.168.1.0/24 EXTERNAL_NET !$HOME_NET output alert_fast: /var/log/snort/fast_alert.txt I am using pulledpork for my one snort.rules file. I run snort as so: snort -d -c /etc/snort/snort.conf -vv also, It might be important information that I do not have eth0 as a network device option. How can I make snort alert me for all machines/IP's on the network? ------------------------------------------------------------------------------ Monitor 25 network devices or servers for free with OpManager! OpManager is web-based network management software that monitors network devices and physical & virtual servers, alerts via email & sms for fault. Monitor 25 devices for free with no restriction. Download now http://ad.doubleclick.net/ddm/clk/292181274;119417398;o _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Snort only alerting about IP its running on Rahul Bhonsale (Jun 26)
- Re: Snort only alerting about IP its running on Al Lewis (allewi) (Jun 26)
- Re: Snort only alerting about IP its running on Al Lewis (allewi) (Jun 26)