Snort mailing list archives
RE: My SNMP woes continue
From: Gary Danko <GDanko () proflowers com>
Date: Wed, 6 Aug 2003 09:29:52 -0700
Hmm it isn't looking good! I symlinked the snort 2.0.1 binary to /usr/local/bin because demarc doesn't want to use the path I've specified. Here's what I have now. [root@ids1 ~]$ /usr/local/bin/snort -V -*> Snort! <*- Version 2.0.1 (Build 88) By Martin Roesch (roesch () sourcefire com, www.snort.org) [root@ids1 ~]$ ldd /usr/local/bin/snort libcrypto.so.2 => /lib/libcrypto.so.2 (0x40027000) libz.so.1 => /usr/lib/libz.so.1 (0x400ea000) libpcap.so.0.6.2 => /usr/lib/libpcap.so.0.6.2 (0x400f8000) libm.so.6 => /lib/i686/libm.so.6 (0x40113000) libnsl.so.1 => /lib/libnsl.so.1 (0x40136000) libmysqlclient.so.10 => /usr/lib/mysql/libmysqlclient.so.10 (0x4014c000) libnetsnmp.so.5 => /usr/local/net-snmp/lib/libnetsnmp.so.5 (0x40182000) libssl.so.2 => /lib/libssl.so.2 (0x401ed000) libc.so.6 => /lib/i686/libc.so.6 (0x4021a000) libdl.so.2 => /lib/libdl.so.2 (0x40355000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x40359000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) So it's all looking good. [root@ids1 conf]$ Running in IDS mode Log directory = /var/log/snort Initializing Network Interface eth1 OpenPcap() device eth1 network lookup: eth1: no IPv4 address assigned --== Initializing Snort ==-- Rule application order changed to Pass->Alert->Log Initializing Output Plugins! Decoding Ethernet on interface eth1 Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file /usr/local/demarc/conf/snorteth1.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 database: compiled support for ( mysql ) database: configured to use mysql database: user = snort database: database name = snort database: password is set database: host = 10.1.30.60 database: sensor name = ids1 database: sensor id = 2 database: inconsistent cid information for sid=2 Recovering by rolling forward the cid=26673 database: schema version = 106 database: using the "log" facility snmp_parse_args1585 Snort rules read... 1585 Option Chains linked into 222 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->pass->activation->dynamic->alert->log --== Initialization Complete ==-- -*> Snort! <*- Version 2.0.1 (Build 88) By Martin Roesch (roesch () sourcefire com, www.snort.org) SNMP seems to have loaded up. But Demarc, which uses the same configuration file and binary complains.... Running in IDS mode Log directory = /usr/local/demarc/tmp TCPDUMP file reading mode. Reading network traffic from "/usr/local/demarc/cgi/stub_traffic_file" file. snaplen = 96 --== Initializing Snort ==-- Initializing Output Plugins! Parsing Rules file /usr/local/demarc/tmp/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... Initializing Preprocessors! Initializing Plug-ins! No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 command line overrides rules file alert plugin! ERROR: unknown output plugin: 'trap_snmp'Fatal Error, Quitting.. ######################################## Issued following command: /usr/local/bin/snort -N -A none -p -T -r /usr/local/demarc/cgi/stub_traffic_file -l /usr/local/demarc/tmp -c /usr/local/demarc/tmp/snort.conf 2>&1 ######################################## Demarc works a little differently. You paste your Snort.conf into an edit window and save. Demarc then saves that to a file. I think its also stored in the DB. Nonetheless, I pasted the snmp output plugin into the Snort.conf in Demarc but it still isn't loading. Argh. ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- My SNMP woes continue Gary Danko (Aug 05)
- Re: My SNMP woes continue Ralf Spenneberg (Aug 06)
- <Possible follow-ups>
- RE: My SNMP woes continue Gary Danko (Aug 06)
- RE: My SNMP woes continue Gary Danko (Aug 06)
- RE: My SNMP woes continue Gary Danko (Aug 06)