Re: Snort-2.9.6.0 Packet Capturing

[Y M <snort () outlook com>]

The command line switches supplied with your Snort command determine what mode you are/will be running Snort in: 
http://manual.snort.org/node3.html.  If you continue the documentation from there, you can see how each mode can be 
utilized.
 
YM
 
Date: Sat, 22 Mar 2014 22:42:52 +0530
From: nandu7ninja () gmail com
To: snort-users () lists sourceforge net
Subject: [Snort-users] Snort-2.9.6.0 Packet Capturing

Hello 

By default on what mode does snort run? how to check on what mode snort is running? how to change mode to TAP mode




On Sat, Mar 22, 2014 at 7:56 PM, praveen_recker . <praveen_recker () sify com> wrote:


Hi Nanda,
For Enterprise grade Routers/AP's you can use SAPN/TAP mode or Port Mirroring to achieve your requirement.
AP which you are using might not support Port Mirroring. Just by enabling Promiscous mode on the machine which is 
running Snort will not solve the purpose, you should enable Promiscous mode on the Interface which ur Snort machine is 
connected and which is difficult to do.



Hope this helps.
Best Regards,Praveen Darshanam

On Sat, Mar 22, 2014 at 5:56 PM, Nanda Vardhan <nandu7ninja () gmail com> wrote:



Then how to capture packets of all the devices that are connected to the network on which snort is running. Is there 
anyway to capture and alert based on snort rules. I didnt install tcpdump, Does it help any? So please help me to this 
problem..  If its not possible whats the use of running snort in IDS mode? 





On Friday, March 21, 2014, Joel Esler (jesler) <jesler () cisco com> wrote:









You can’t sniff packets of other devices?  Well, no, you can’t do that.  You need to sniff from the device the traffic 
is actually
on.



--

Joel Esler

Open Source Manager

Threat Intelligence Team Lead

Vulnerability Research Team




On Mar 21, 2014, at 6:45 AM, Nanda Vardhan <nandu7ninja () gmail com> wrote:




I am a newbie of Snort IDS. I installed Snort 2.9.6.0 on ubuntu. I want to sniff packets from all the devices connected 
to wifi router and get alerts based on some rules I defined. I manually setup NIC
 to promiscuous mode. My problem is that I cannot sniff packets of other devices. Am getting packet information of only 
laptop on which Snort is running.




I used following command:

$ sudo snort -c  snort.conf -A console -i wlan0




Output:

           Preprocessor Object: SF_DNP3  Version 1.1  <Build 1>

           Preprocessor Object: SF_IMAP  Version 1.0  <Build 1>

           Preprocessor Object: SF_SIP  Version 1.1  <Build 1>

           Preprocessor Object: SF_DNS  Version 1.1  <Build 4>

           Preprocessor Object: SF_SSLPP  Version 1.1  <Build 4>

Commencing packet processing (pid=3312)


------------------------------------------------------------------------------

Learn Graph Databases - Download FREE O'Reilly Book

"Graph Databases" is the definitive new guide to graph databases and their

applications. Written by three acclaimed leaders in the field,

this first edition is now available. Download your free book today!

http://p.sf.net/sfu/13534_NeoTech_______________________________________________

Snort-users mailing list

Snort-users () lists sourceforge net

Go to this URL to change user options or unsubscribe:

https://lists.sourceforge.net/lists/listinfo/snort-users

Snort-users list archive:

http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users



Please visit http://blog.snort.org to stay current on all the latest Snort news!








-- 
Sent from Nanda's iPad


------------------------------------------------------------------------------

Learn Graph Databases - Download FREE O'Reilly Book

"Graph Databases" is the definitive new guide to graph databases and their

applications. Written by three acclaimed leaders in the field,

this first edition is now available. Download your free book today!

http://p.sf.net/sfu/13534_NeoTech
_______________________________________________

Snort-users mailing list

Snort-users () lists sourceforge net

Go to this URL to change user options or unsubscribe:

https://lists.sourceforge.net/lists/listinfo/snort-users

Snort-users list archive:

http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users



Please visit http://blog.snort.org to stay current on all the latest Snort news!






-- 
Sent from Nanda's iPad


------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and their
applications. Written by three acclaimed leaders in the field,
this first edition is now available. Download your free book today!
http://p.sf.net/sfu/13534_NeoTech
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!                                        

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!