Snort mailing list archives
Re: No Alerts Being Generated
From: Martin Roesch <roesch () sourcefire com>
Date: Wed, 6 Oct 2004 10:00:36 -0400
Have you tried making a test rule? How about: alert tcp any any -> any any (msg: "TCP packet";) put that in a file called test.rule then run snort -c test.rule -A console -Nfor a couple minutes and surf around the web, you should have alerts. If you don't have alerts then something is probably configured wrong, if you do have alerts then your test case (running Newt in front of Snort) probably isn't generating anything that Snort is looking for. Try running some real attacks or an nmap fingerprint scan.
-Marty On Oct 6, 2004, at 8:00 AM, Kaplan, Andrew H. wrote:
Hi there -- (sorry if this a repeat of a message sent out)I made the change within the snort.conf file you had suggested. I also ran thesnort -T commandand it ran through the configuration without reporting back any errors. Finally,I installed NeWT,the Windows version of Nessus, on another machine and ran several differenttests on the snort box.The tests I ran were portscans and the "SANS Top 20" list. After the scans werefinished, I checked the alert file as well as the ACID GUI. Neither one mentioned any alert conditions taking place.As a further test, I changed the !HOME_NET setting back to any to see if thatmade any difference. It did not. What should I look for next? -----Original Message----- From: Nigel Houghton [mailto:nigel () sourcefire com] Sent: Wednesday, September 29, 2004 4:57 PM To: snort-users () lists sourceforge net Cc: Kaplan, Andrew H. Subject: Re: [Snort-users] No Alerts Being GeneratedWell the first thing I see in your file is the EXTERNAL_NET variable is setto any. You might want to set that to !$HOME_NET for a start.Second, you can run snort -T -c /etc/snort/snort.conf to test your snortconfiguration.Next thing is to make sure your snort box is listening on a span port of a switch or a tap or a hub (probably not using one in your case I think) andthat the span port/tap is configured correctly.Then, if possible, you could try generating some traffic that Snort shouldalert on, like maybe a web request for ftp.pl which should set off sid 1107. You could run some nessus tests or just do it manually with astraightforward http://www.yourwebhost.org/ftp.pl or pick some other simplerule to test. On 0, snort-users-request () lists sourceforge net allegedly wrote:3. No Alerts Being Generated (Kaplan, Andrew H.) --__--__-- Message: 3 From: "Kaplan, Andrew H." <AHKAPLAN () PARTNERS ORG> To: "Snort User Group (E-mail)" <snort-users () lists sourceforge net> Date: Wed, 29 Sep 2004 15:35:26 -0400 Subject: [Snort-users] No Alerts Being GeneratedThis message is in MIME format. Since your mail reader does not understandthis format, some or all of this message may not be legible. ------_=_NextPart_000_01C4A65B.7895D89C Content-Type: text/plain; charset="iso-8859-1"I completed installing snort 2.2.0 (build 30) and have begun running it. TheACID GUI and /var/log/snort/alert files have not shown any alertseven though the program has been running for over an hour. To verify therewereno syntax errors in the snort.conf file, I ran the following: snort -c /etc/snort/snort.confThere were no errors and warnings, and the program appears to be runningproperly. Where in snort.conf and elsewhere, should I check forconfiguration mistakes? I have included the snort.conf file here. Thanks.<<snort.conf.29sept04.txt>>-------------------------------------------------------This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out morehttp://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-- Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616 Sourcefire - Discover. Determine. Defend. roesch () sourcefire com - http://www.sourcefire.com Snort: Open Source Network IDS - http://www.snort.org ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- RE: No Alerts Being Generated Kaplan, Andrew H. (Oct 05)
- <Possible follow-ups>
- RE: No Alerts Being Generated Kaplan, Andrew H. (Oct 06)
- Re: No Alerts Being Generated Martin Roesch (Oct 06)
- RE: No Alerts Being Generated Lance Boon (Oct 06)
- RE: No Alerts Being Generated Kaplan, Andrew H. (Oct 06)
- Re: No Alerts Being Generated sekure (Oct 06)
- RE: No Alerts Being Generated Kaplan, Andrew H. (Oct 06)
- RE: No Alerts Being Generated Lance Boon (Oct 06)
- RE: No Alerts Being Generated Kaplan, Andrew H. (Oct 06)
- RE: No Alerts Being Generated Michael Steele (Oct 06)