Strange snort behaviour, failure to log all traffic.

[hulver <hulver () gmail com>]

I'm having some very strange problems with snort not capturing all packets.

I've been running snort for ages, and I've recently upgraded it to try
and fix this problem, I'm now running snort 2.3.3 (build 14). I
compiled it from source. My libpcap is 0.7. I'm running it on Debian
machine running a 2.4.18 kernel.

My problem is, snort only logs traffic where the sensors IP address is
involved. My sensor is 192.168.1.3, and the only stuff in my logs is
to or from IP 192.168.1.3. It used to log all traffic going past the
sensor (which is installed next to the router).

Now, here's the strange part.

If I run "snort -v" from the command line, I can see all traffic to
all IP's on my network. What's even stranger, is that if I run "snort
-v" suddenly the daemon version will also start logging that traffic
as well.

I set up a rule to test this.

ruletype logall
{
  type log
  output log_tcpdump: complaint.log
}
logall tcp 62.172.x.x any <> any any
logall udp 62.172.x.x any <> any any
logall icmp 62.172.x.x any <> any any

I restarted snort, and started pinging the 62.172.x.x address from
another machine on the network. Nothing was logged. I then ran "snort
-v > /dev/null &" and did then ping again. Now packets started getting
logged to the log file. I stopped the "snort -v" instance and ran the
ping again. Nothing was logged.

I've checked, and the interface is in PROMISC mode no matter how many
instances of snort I'm running, but I only get to log all traffic if I
run a "snort -v" in the background.

Can anybody help?

-- 
http://www.hulver.com/scoop/


-------------------------------------------------------
SF.Net email is sponsored by: Discover Easy Linux Migration Strategies
from IBM. Find simple to follow Roadmaps, straightforward articles,
informative Webcasts and more! Get everything you need to get up to
speed, fast. http://ads.osdn.com/?ad_idt77&alloc_id492&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users