Re: HTTP INSPECT fails on Mirror Port

[Anand Raj Manickam <anandrm () gmail com>]

I do not see a change , its the same.
Screen shot : http://pastebin.com/XpcHjRqB


On Fri, Jul 18, 2014 at 5:21 PM, Joel Esler (jesler) <jesler () cisco com> wrote:
> Can you add -k none to the command line and see what happens?
>
> --
> Joel Esler
> Sent from my iPhone
>
> > On Jul 18, 2014, at 7:49, "Anand Raj Manickam" <anandrm () gmail com> wrote:
> >
> > Hi,
> > I have the snort configured on Mirror Port of a Switch . Snort fails
> > to detect HTTP but , It does detect the TCP and Stream5.
> > The Stream5 Stats only show that it Tracks . I have the http_inspect
> > and http_inspect_server preprocessors are configured.
> > But when configured on read from pcap file , with the same config the
> > HTTP is detected .
> > Can someone shed some light on whats missing in my configuration on
> > live Mirror port mode?
> >
> > # snort --daq-list
> > Available DAQ modules:
> > pcap(v3): readback live multi unpriv
> > nfq(v7): live inline multi
> > ipfw(v3): live inline multi unpriv
> > dump(v2): readback live inline multi unpriv
> >
> > The config file : http://pastebin.com/qUpTfRLY
> > The Snort Stats : http://pastebin.com/ADWvJAZQ
> >
> > With a pcap file , the HTTP Inspect is fine :
> > snort  -c /snort-2.9.6.1/etc/snort.conf  -r /data/test.pcap
> >
> > Thanks,
> >
> > ------------------------------------------------------------------------------
> > Want fast and easy access to all the code in your enterprise? Index and
> > search up to 200,000 lines of code with a free copy of Black Duck
> > Code Sight - the same software that powers the world's largest code
> > search on Ohloh, the Black Duck Open Hub! Try it now.
> > http://p.sf.net/sfu/bds
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Want fast and easy access to all the code in your enterprise? Index and
search up to 200,000 lines of code with a free copy of Black Duck
Code Sight - the same software that powers the world's largest code
search on Ohloh, the Black Duck Open Hub! Try it now.
http://p.sf.net/sfu/bds
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!