Snort mailing list archives
Not logging everything
From: "Chuck Holley" <cholley () fitnessquest com>
Date: Tue, 20 Apr 2004 08:40:51 -0400
This is my problem. I have a snort box (setup using Patrick Harpers install guide for Fedora C1) local to the switch that all of my servers reside on. I set the switch (HP 2848) to monitor the port which is uplinked to my router, and to mirror the traffic to the port my snort box is on. I did a lot of scanning last night from home using "nmap" and the "cis" scanning tools. I wrote down the ip address that my ISP gave me, came in this morning to see what snort had logged through ACID; and there was one alert to one of my servers. I pinged and scanned about 10 servers last night, and it only got one????? My question is, are packets being dropped at my switch or is snort not logging properly due to some options not being specified. If I run nmap locally, snort pretty much gets it all, although it takes a little while to see in ACID. Thanks Chuck Holley LAN Administrator FitnessQuest Inc. Canton, OH cholley () fitnessquest com
Current thread:
- Not logging everything Chuck Holley (Apr 20)
- RE: Not logging everything Fred Portnoy (Apr 20)
- RE: Not logging everything Chuck Holley (Apr 20)
- RE: Not logging everything Fred Portnoy (Apr 20)