Snort mailing list archives
RE: snort.conf and rules
From: "Watson, Ed" <ewatson () academic com>
Date: Tue, 15 May 2001 09:45:24 -0700
This is what I did: vi vision.rules :%s/$EXTERNAL/$EXTERNAL_NET/ and :%s/$INTERNAL/$HOME_NET/ default snort is looking for $EXTERNAL_NET in the rules files. same as for $HOME_NET. I haven't tried the [], but the above worked well for me. Ed -----Original Message----- From: Bunter, Matthew [mailto:Matthew.Bunter () cwcom cwplc com] Sent: Tuesday, May 15, 2001 5:19 AM To: Snort-Users (E-mail) Subject: [Snort-users] snort.conf and rules All, Still having problems getting snort started and would appreciate any help. using vision.rules (vision.rules.gz from whitehats) Snort 1.7 Got my DNS boxes specified, no SMTP boxes on my segment (used nmap to verify), ignoring SQL boxes therefore commented out. Preprocessors : defrag http_decode: 80 8080 portscan: $HOME_NET 4 3 /var/log/snort/portscan.log portscan-ignorehosts: $DNS_SERVERS Output alert_syslog: LOG_AUTH LOG_ALERT - forgive my stupidity but does anything need to be done to syslog.conf? DO any files need to be touched before running snort? Rule Set include /etc/snort/Rules/vision.rules My local.rules is commented out. What sort of include/ignores do people have that isn't covered in the DNS, SQL, SMTP areas of snort.conf? Could anyone point me to an example local.rules file? With all the above I am getting error messages that tell me things are wrong with the rules e.g. vision.rules (1) => Invalid CIDR block for IP addr 1024 : If I comment this out I then get Port value missing in rule for rule 2, same for rule 3. I'm just trying to get Snort working Please help - going crazy! Regards, Matt ********************************************************************** This message may contain information which is confidential or privileged. If you are not the intended recipient, please advise the sender immediately by reply e-mail and delete this message and any attachments without retaining a copy. ********************************************************************** _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: http://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort.conf and rules Bunter, Matthew (May 15)
- <Possible follow-ups>
- RE: snort.conf and rules Bunter, Matthew (May 15)
- RE: snort.conf and rules Watson, Ed (May 15)