Snort not detect attack on mirroring port

[Сергей Беляев via Snort-users <snort-users () lists snort org>]

Hellow.
  Excuse me for my bad english.
  I Iinstall snort 2.9.11 on ubuntu 12.04 from sources and connect it to HP ProCurve 2510G mirror port.
  My mirroring scheme in file mirror.pdf and snort host configuration in file snort_host_conf.png
  I tried attack my test windows xp machine from kali by script ms_08_067_netapi.rb, which exploits cve-2008-4250 
vulnerability. And snort not detect it.
  Then i tried the same attack from  kali to windows xp via linux in routing mode - scheme snort_on_router.pdf
  And in this scheme snort detect attacks successfully by triggering rule sid 14782 in file os-windows.rules 
  My snort config in snort.tar.gz
  May be it is bag that snort not detect attack from mirroring traffic?
  Installing snort 2.9.13 to ubuntu 16.04 - same result.


Sergey

Attachment: mirror.pdf
Description:

Attachment: snort.tar.gz
Description:

Attachment: snort_on_router.pdf
Description:

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette