Re: Re: I don't get any alerts when reading from file.

[<dimopoulos () mhl tuc gr>]

First of all, thanks for your time!
 Now, here is the entire process I use. I have written a small program in
 C++ that reads all the .rules files that have a 'content' field and
 generates fake IP packets that match those rules. The packets contain all
 the necessary header data (IP and TCP/UDP) to match the rule along with
 the necessary payload (random but with content that matches that of the
 rule). I write these packets in hexdump format and then use the tool
 'text2pcap' of Ethereal to convert it from hexdump to tcpdump
 format,using teh command line "text2pcap -q -l 12 <source>
 <destination>", and after that I take the newly generated file and feed
 it to snort. Using the -vd switches I can see that the IP addresses,
 ports and payload are ok (i.e. should match) yet I get nothing. And the
 fake samples I use are large enough (250000 packets) that at least some
 should have triggered.

> How did you create the tcpdump file?  What was the command line you
> used with tcpdump?
>
> Can you try running Snort like this:
>
> snort -c snort.conf -A console -b -r test.txt
>
> What makes you think that every packet should be generating an alert?
> Which SID do you expect to be firing?
>
> You might want to start with a simpler test to just detect the specific
>  alert that you're looking for.  You could even write a custom rule for
>  it...
>
>      -Marty
>
>
>
> --
> Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616
> Sourcefire: Intelligent Security Monitoring
> roesch () sourcefire com - http://www.sourcefire.com
> Snort: Open Source Network IDS - http://www.snort.org





-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users