Re: Rules not matching, or matching without logic

[Vanja Hrustic <vanja () pobox com>]

On Sat, 19 Nov 2005 10:45:49 -0500
Jeff Kell <jeff-kell () utc edu> wrote:

> Vanja Hrustic wrote:
>
> Is the Cat4500 port set as a monitor destination?  For a 4500 you
> need a monitor session setup properly, and you need to insure that
> the session includes the traffic you are trying to snort.  Typically
> this is the switch uplink.  For example, if your uplink is on gig1/1
> and your eth1 is connected to gig2/24, you need something like:
>
> > monitor session 1 source interface Gi1/1
> > monitor session 1 destination interface Gi2/21

Not in the office right now, but I think it was setup in this way
(another guy set it up, so I'm not 100% sure). 

> That will get you copies of traffic over the uplink, but of course it
> will not see traffic between ports on the same switch unless you're
> monitoring an SVI or vlan that includes that traffic.  You didn't
> give details about your setup, but it certainly sounds like the
> monitor session is incorrect. 

I do monitor uplink, and I do get all the traffic, but I'll check the
exact setup tomorrow. Thanks for the details anyway.

> You don't have stream reassembly enabled in your configuration.
> You're also using "flow:" keywords in some of your rules, yet your
> flow preprocessor configuration is commented out.  Consequently,
> flow: won't work.
<snip>
> Again, you don't have flow enabled.
>  
<snip>
> The 2nd rule doesn't use flow.  And you typing 'console' during a
> telnet session won't be reassembled, so it won't be seen in one
> contiguous packet.

Yes, the pasted rules have preprocessors disabled, but that's just
AFTER I've tried every single combination. They were all enabled
before, and I was just disabling them one by one, in hope that
something will change.

Thanks anyway.

Vanja


-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc.  Get Certified Today
Register for a JBoss Training Course.  Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users