Re: Snort-2.9.6.0 Packet Capturing

[Anacleto Junior <suporte.anacleto () gmail com>]

Certainly it's gonna be useful for me. Thanks for sharing.


2014-03-22 13:21 GMT-03:00 Tony Robinson <deusexmachina667 () gmail com>:

> I wrote up an article relating to this a little while ago, called
> "Introduction to IDS and IPS concepts" On a wiki I'm hosting on my
> website. I would see people ask the same question constantly "how do I
> get traffic to snort?" So took it upon myself to make a page that
> explains how to pass traffic to your sensor.
>
> https://www.blindseeker.com/wiki/Introduction_to_IDS_and_IPS_concepts
>
> Also, at the bottom of the page are solid references to the wireshark
> wiki for traffic acquisition techniques with more illustrations.
>
> Hope this helps.
>
> On Sat, Mar 22, 2014 at 10:26 AM, praveen_recker .
> <praveen_recker () sify com> wrote:
> > Hi Nanda,
> >
> > For Enterprise grade Routers/AP's you can use SAPN/TAP mode or Port
> > Mirroring to achieve your requirement.
> >
> > AP which you are using might not support Port Mirroring. Just by enabling
> > Promiscous mode on the machine which is running Snort will not solve the
> > purpose, you should enable Promiscous mode on the Interface which ur
> Snort
> > machine is connected and which is difficult to do.
> >
> > Hope this helps.
> >
> > Best Regards,
> > Praveen Darshanam
> >
> >
> > On Sat, Mar 22, 2014 at 5:56 PM, Nanda Vardhan <nandu7ninja () gmail com>
> > wrote:
> > > Then how to capture packets of all the devices that are connected to the
> > > network on which snort is running. Is there anyway to capture and alert
> > > based on snort rules. I didnt install tcpdump, Does it help any? So
> please
> > > help me to this problem..  If its not possible whats the use of running
> > > snort in IDS mode?
> > >
> > > On Friday, March 21, 2014, Joel Esler (jesler) <jesler () cisco com>
> wrote:
> > > > You can't sniff packets of other devices?  Well, no, you can't do that.
> > > > You need to sniff from the device the traffic is actually on.
> > > >
> > > > --
> > > > Joel Esler
> > > > Open Source Manager
> > > > Threat Intelligence Team Lead
> > > > Vulnerability Research Team
> > > >
> > > > On Mar 21, 2014, at 6:45 AM, Nanda Vardhan <nandu7ninja () gmail com>
> wrote:
> > > > I am a newbie of Snort IDS. I installed Snort 2.9.6.0 on ubuntu. I want
> > > > to sniff packets from all the devices connected to wifi router and get
> > > > alerts based on some rules I defined. I manually setup NIC to
> promiscuous
> > > > mode. My problem is that I cannot sniff packets of other devices. Am
> getting
> > > > packet information of only laptop on which Snort is running.
> > > >
> > > > I used following command:
> > > >
> > > > $ sudo snort -c  snort.conf -A console -i wlan0
> > > >
> > > > Output:
> > > >            Preprocessor Object: SF_DNP3  Version 1.1  <Build 1>
> > > >            Preprocessor Object: SF_IMAP  Version 1.0  <Build 1>
> > > >            Preprocessor Object: SF_SIP  Version 1.1  <Build 1>
> > > >            Preprocessor Object: SF_DNS  Version 1.1  <Build 4>
> > > >            Preprocessor Object: SF_SSLPP  Version 1.1  <Build 4>
> > > > Commencing packet processing (pid=3312)
> ------------------------------------------------------------------------------
> > > > Learn Graph Databases - Download FREE O'Reilly Book
> > > > "Graph Databases" is the definitive new guide to graph databases and
> > > > their
> > > > applications. Written by three acclaimed leaders in the field,
> > > > this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech_______________________________________________
> > > > Snort-users mailing list
> > > > Snort-users () lists sourceforge net
> > > > Go to this URL to change user options or unsubscribe:
> > > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > > Snort-users list archive:
> > > > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> > > >
> > > > Please visit http://blog.snort.org to stay current on all the latest
> > > > Snort news!
> > >
> > >
> > > --
> > > Sent from Nanda's iPad
> ------------------------------------------------------------------------------
> > > Learn Graph Databases - Download FREE O'Reilly Book
> > > "Graph Databases" is the definitive new guide to graph databases and
> their
> > > applications. Written by three acclaimed leaders in the field,
> > > this first edition is now available. Download your free book today!
> > > http://p.sf.net/sfu/13534_NeoTech
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> > >
> > > Please visit http://blog.snort.org to stay current on all the latest
> Snort
> > > news!
> ------------------------------------------------------------------------------
> > Learn Graph Databases - Download FREE O'Reilly Book
> > "Graph Databases" is the definitive new guide to graph databases and
> their
> > applications. Written by three acclaimed leaders in the field,
> > this first edition is now available. Download your free book today!
> > http://p.sf.net/sfu/13534_NeoTech
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> Snort
> > news!
>
>
>
> --
> when does reality end? when does fantasy begin?
>
>
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!



-- 
Anacleto Júnior
Analista de TI e Redes
Linux User: #447388

------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!