Re: Help with web servers

[Matt Kettler <mkettler () evi-inc com>]

Impatient aren't we?

First, let's clarify your network configuration.. There's some important 
details you glossed over.

1) is Snort running on the same machine as the NAT-Firewall, or on a 
separate computer inside your network?

2)  If yes to the above, what interface is snort listening on? external or 
internal?

3) is the webserver running on the same machine as the NAT-Firewall, or on 
a separate computer inside your network?

4) when you say the rules "don't work", how did you attempt to trigger 
them. Be VERY specific about the network topology of where the attacks were 
launched from, where they went to, and where snort is relative to all this.



At 01:23 PM 2/24/2003 +0100, Sébastien Bisoglio wrote:
> Hi,
>
> I have just installed Snort on a Debian.
>
> This PC is a Nat-router (with Iptables) and my webserver is a PC with IP
> 192.168.1.10 in my network but people can access it with IP 195.202.209.230 .
>
> I want snort use web rules for this web server.. but if I put 195.202.209.230
> OR 192.168.1.10 IP in the Web server configuration it doesn't work.
>
> Can you help me ?
>
> I have activated all rules for web (web-attack, web-iis....)
>
> Thanx
>
> E-mail : sebastienb () urbanet ch
>
>
> -------------------------------------------------------
> This sf.net email is sponsored by:ThinkGeek
> Welcome to geek heaven.
> http://thinkgeek.com/sf
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users