Re: Basic snort setup for processing pcap produces no alerts

[Egon Kidmose <kidmose () gmail com>]

Hi James, Rmkml, Bassant

Thanks for your inputs!

> "-k none" switch on command
Doesn't improve things.
I've also noticed the following in the console output: "Bad Chk
Sum:            0 (  0.000%)"
This leads me to believe that my issue isn't related to checksums.

> DARPA 1999 for reference dataset
http://www.ll.mit.edu/mission/communications/cyber/CSTcorpora/ideval/data/1999data.html
I'm getting some alerts,
2-4 a day for inside and outside respectively, which corresponds reasonably
well to what the documentation suggests.

> Another check if you have enabled no ethernet (don't remember exactly
what name)
> on configure option please? ( New on v2.9.6.0)
I've not been able figure what this config is, but as the DARPA set works I
guess it might not be crucial..

It would seem that my config is fine, while my expectation that my trace
should trigger alerts is wrong.
The good thing is that I got snort running, that bad thing is that it
doesn't do what I need, yet :)
I'll look into adding more rules, possibly my own.

Once again; Thanks!



Mvh/BR
Egon Kidmose


On Wed, Mar 26, 2014 at 12:41 PM, basant subba <basantsubba () gmail com>wrote:

> Try running  Snort on some standard dataset like DARPA 1999 dataset. If it
> generates alarm for DARPA dataset then there's nothing wrong with
> configuration else there might be some misconfiguration.
>
>
> On Wed, Mar 26, 2014 at 4:05 PM, Egon Kidmose <kidmose () gmail com> wrote:
>
> > Hi all,
> >
> > I am working with snort for the first time, trying to feed in a pcap with
> > known bad traffic and hoping to get out a list of alerts.
> >
> > I use snortrules-snapshot-2960.tar.gz from http://snort.org/snort-rules/without pulledpork as I don't need to get 
> > updates.
> > My pcap contains a trace from a controlled environment where I have
> > infected and remote controlled a machine with the fairly old irc bot sdbot,
> > so I expect some reaction from snort, however I get none.
> >
> > My thought is that the absence of alerts follows from one of the
> > following:
> > a) incorrect configuration
> > b) my trace not being "bad enough" for snort to pick it up
> > c) or something else...
> >
> > Is there anyone out there who can help me to fix the configuration, point
> > me to some reference trace that certainly triggers an alert or simply
> > provide possibly useful hints/suggestions/insights?
> > Anything would be greatly appreciated!
> >
> >
> >
> >
> >
> > # command used:
> >  ~/git-reps/.../sdbot05b-2014-03-25-1020 $ snort -c
> > ../rules/snortrules-snapshot-2960/etc/snort.conf -r sdbot05b.pcap
> > # output from running snort
> > http://kom.aau.dk/~ekidmose/snort-example/output.txt
> > # snort version:
> >  ~/git-reps/.../sdbot05b-2014-03-25-1020 $ snort -V
> >
> >    ,,_     -*> Snort! <*-
> >   o"  )~   Version 2.9.6.0 GRE (Build 47)
> >    ''''    By Martin Roesch & The Snort Team:
> > http://www.snort.org/snort/snort-team
> >            Copyright (C) 2014 Cisco and/or its affiliates. All rights
> > reserved.
> >            Copyright (C) 1998-2013 Sourcefire, Inc., et al.
> >            Using libpcap version 1.3.0
> >            Using PCRE version: 8.31 2012-07-06
> >            Using ZLIB version: 1.2.7
> > # My pcap and the rules with my modifications
> > http://kom.aau.dk/~ekidmose/snort-example.tar.gz
> > http://kom.aau.dk/~ekidmose/snort-example/
> >
> >
> >
> >
> > Mvh/BR
> > Egon Kidmose
> >
> >
> >
> > ------------------------------------------------------------------------------
> > Learn Graph Databases - Download FREE O'Reilly Book
> > "Graph Databases" is the definitive new guide to graph databases and their
> > applications. Written by three acclaimed leaders in the field,
> > this first edition is now available. Download your free book today!
> > http://p.sf.net/sfu/13534_NeoTech
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> > Snort news!
------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!