Snort mailing list archives
problems with snort rules
From: Valerius Travasso <valeriustravasso () gmail com>
Date: Thu, 3 Sep 2015 11:03:35 +0530
OK so first problem 1) activate tcp ***.***.***.*** any <> any any (content:"www.******.com"; msg:"somebody is accessing www.******.com"; activates:1212; sid:0000002;) dynamic tcp ***.***.***.*** any <> any any (msg:"action was activated as ****** was accessed"; activated_by:1212; count:5; sid:0000003;) when i ruh this rule with sudo snort -A console -c /etc/snort/snort.conf -i eth0 the activate part works fine but the dynamic rule part shows following warning WARNING: an activation rule with no dynamic rules matched. 2) i m having some problem with log i want to log specific packets only in the directory var/log/snort i get the log file of the entire run alert icmp ***.***.***.*** any -> ***.***.***.*** any (msg:"GOT PING BY PC 8"; sid:0000006;) also nothing in the log folder in etc/snort/log did not get anything with logto i know we cant use logto when snort is in binary mode have barnyard installed does it affects logto option ------------------------------------------------------------------------------ Monitor Your Dynamic Infrastructure at Any Scale With Datadog! Get real-time metrics from all of your servers, apps and tools in one place. SourceForge users - Click here to start your Free Trial of Datadog now! http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140 _______________________________________________ Snort-sigs mailing list Snort-sigs () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-sigs http://www.snort.org Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- problems with snort rules Valerius Travasso (Sep 02)
- Re: problems with snort rules waldo kitty (Sep 03)
- Re: problems with snort rules Valerius Travasso (Sep 08)
- Re: problems with snort rules Joel Esler (jesler) (Sep 09)
- Re: problems with snort rules Valerius Travasso (Sep 08)
- Re: problems with snort rules waldo kitty (Sep 03)