Snort mailing list archives
Re: Fw: snort not reporting
From: "Ben van der Merwe" <benm () pasco co za>
Date: Tue, 14 Dec 2004 13:03:12 +0200
Allan, sorry you are right. -A is for alerts and -b is for binary logging.The log file is deleted because it is empty. This is also the reason why there are no alerts.
You can try to verify the traffic generated by ppp0. It should not be 0 if you have a successful connection and do some stuff. Try using a tool like etherape or ethereal to monitor your ppp0 sensor. It should generate traffic in logging (-b) mode. On linux 'dmesg' will also be helpful in identifying some other problems.
Let me know if you can detect the traffic in any way using another tool. Ben----- Original Message ----- From: "Allan Jensen" <tubajensen () yahoo com>
To: "Ben van der Merwe" <benm () pasco co za> Cc: "Snort Users" <snort-users () lists sourceforge net> Sent: Tuesday, December 14, 2004 12:52 PM Subject: Re: Fw: [Snort-users] snort not reporting
Ben, I tried this command: sudo snort -bi ppp0 -c /etc/snort/snort.conf (-b Log packets in tcpdump format) The -A option just sets the alert mode (That's not what I want - is it?) Using the -b option I find a file in /var/log/snort named: -rw------- 1 root wheel 0 14 Dec 11:35 snort.log.1103020543 As you can see it's size is 0. It also disappears when I quit snort. Allan. --- Ben van der Merwe <benm () pasco co za> wrote:Allan, I experienced the same problem when I first tried snort (with rules), but my project only focused on binary logging so I did not get the opportunity to fix it. That may be a good idea - try out the binary logging (I think there is a '-A' option then) and make sure that the traffic is logged to a binary file. You can then inspect the traffic with tools like 'ethereal', 'etherape' and 'tcpdump'. At least you can narrow down the problem area in this way.__________________________________ Do you Yahoo!? Yahoo! Mail - now with 250MB free storage. Learn more.http://info.mail.yahoo.com/mail_250
------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users.Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort not reporting Allan Jensen (Dec 12)
- <Possible follow-ups>
- snort not reporting Allan Jensen (Dec 13)
- RE: snort not reporting Patrick S. Harper (Dec 13)
- RE: snort not reporting Allan Jensen (Dec 13)
- Re: snort not reporting Kevin Johnson (Dec 13)
- Re: snort not reporting Allan Jensen (Dec 13)
- RE: snort not reporting Patrick S. Harper (Dec 13)
- Re: Fw: snort not reporting Ben van der Merwe (Dec 13)
- Re: Fw: snort not reporting Allan Jensen (Dec 14)
- Re: Fw: snort not reporting Ben van der Merwe (Dec 14)
- Re: Fw: snort not reporting Ben van der Merwe (Dec 14)
- Re: Fw: snort not reporting Allan Jensen (Dec 14)