Re: Snort only alert about traffic with an specific IP

[Leon Ward <seclists () rm-rf co uk>]

Sounds like a data presentation issue to me.
Check Snort is seeing the traffic that you think it should be.

snort -vdei eth0

or check it out with another sniffer like tcpdump. Was the rule that  
didn't involve your IP a broadcast packet?

-Leon


On 26 May 2008, at 11:13, Berta Alcala wrote:

> Hello,
>
> I have many problems with snort, for example some rules work fine  
> and others don't work. But what surprises me a lot is that snort  
> only alert about rules with my IP (where snort is installed) as  
> source or destination .
>
> I've tried with this rule:
>
> alert tcp any any -> any any (msg:"TCP traffic";sid:1000011; rev:1;)
>
> The only alerts registrated are those which have my IP. I don't  
> understang anything.
> I have this information in snort.conf:
>
> var HOME_NET 172.18.64.0/19
> var EXTERNAL_NET any
> var DNS_SERVERS $HOME_NET
> var SMTP_SERVERS $HOME_NET
> var HTTP_SERVERS $HOME_NET
> var SQL_SERVERS $HOME_NET
> var TELNET_SERVERS $HOME_NET
> var SNMP_SERVERS $HOME_NET
>
> Snort is installed in 172.18.65.16. There are many others IPs  
> availables in my network.
> Other rare thing, I changed $EXTERNAL_NET to any in a rule and then  
> it worked, but I have rules with $EXTERNAL_NET that work fine.
> (I use Windows XP+Snort 2.7+Base)
>
> Thank you very much for any idea
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users