RE: Configuration issue, Part II

["DJDave Sobel" <dave () evolvetech com>]

Erik:

I think we're on to something with your last comment..

I think snort is only binding to the lowest interface, which would
explain why it's only seeing the traffic it is.

How do you specify which interface to use?

And of more importance to me, how do you specify binding to multiple
interfaces?  I'd like it to be watching traffic to all the internal
networks, not just one... (that way, I can see what ipchains missed..)

Dave

-----Original Message-----
From: Erek Adams [mailto:erek () theadamsfamily net] 
Sent: Monday, September 24, 2001 2:24 AM
To: DJDave Sobel
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Configuration issue, Part II

On Sun, 23 Sep 2001, DJDave Sobel wrote:

> First off, thanks to everyone who's lended a hand -- I do appreciate
it.
> Let me know where to send the coffee and/or beer...

:)

> Now, to save bandwidth, I compiled my answers to everyone's questions
> into this one email. :) Thus, those not interested only need ignore
one
> message.
>
> First off, to answer Erik Adams (erek () theadamsfamily net):
>       Tell me where to send your beer... Snort is located on my Linux
> router, so it's on a machine with 6 network interfaces.  Two are
> connected to the Internet, and four are to the internal networks.  I
use
> ipchains to block various unfriendly traffic, and control who can see

Ahhhh....  I think I see a possible problem!  Have a look at this:

http://snort.sourcefire.com/docs/faq.html#4.3

Basically, snort sits 'behind' the ipchains and ipf programs.  They see
the
packets before snort does.  If you've got things setup to drop/deny
packets
that you are expecting to see with snort, then you won't.

> who, but all traffic passes across this machine.  All the interfaces
> have been put into PROMISC mode (as I believed snort needed this).
> It's placement on this machine would make me think it can see
everything
> that goes in and out of the network.

As well it should.

>       It CAN see some traffic -- it does happily report on things it
> sees internally, such as samba communications and nameserver
> communications within the network.  Additionally, it does seem to
report
> occasional things from the outside.
>       I performed this test, per your instructions:
>               snort -dv host <webserver_IP>
>       Snort displayed a great deal about communications going on
> within the network.   However, only things within the network for the
> time I watched.
>       I then went to route-server.cerf.net and pinged the same
> webserver -- it did NOT report anything.

Odd.  Depending on your firewall rules, this might be expected.  Unless
you
are blocking packets, you should see the ping traffic in the snort
window.


[...snip...]

> Now, John Berkers (berjo () ozemail com au):
>       Where do you want your coffee?  As for output plugins, you're
> right -- I didn't configure any.  However, even in this state, snort
> does log alerts to /var/log/snort/alert and
/var/log/snort/portscan.log
> .  I assumed this was the default configuration, and this works for my
> needs right now.  I thought I'd get it working before adding on a
mySQL
> backend and such.

Good idea.  Getting ACID up and running is not hard task, it's just got
a lot
of dependencies.

>       Is this not a true assumption?  If so, cool... if not, then why
> is it logging to these two files even without me saying so?

True sir!

[...snip...]

I _really_ don't think it's your configs.  Your configs look quite sane
to
me--Oh wait, I'm not sane....  :)  Seriously, they look fine.  The only
things
that were amiss were corrected already.

Hold on...  You've got 2 external interfaces?  When you start snort
which
interface are you telling it to watch?  If you don't specify, it will
look at
the lowest numbered one.  If your traffic is coming in via the other
interface, then that would explain it.  (Yeah, I could have deleted all
that
and re-written, but I'm lazy. ;-)

Good luck!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users