Snort mailing list archives
Problems running Snort
From: "Edward Sohn" <edwardsohn () sbcglobal net>
Date: Thu, 21 Oct 2004 18:22:31 -0700
I am a Snort and Linux newbie, and I appreciate your Snort installation guide. I'm having problems, however... I have everything installed and running on Fedora Core 2 in VMWare 4.5.2 on Windows XP in bridged mode. I can see Snort working when I run it in verbose (I can see the packet captures) I have the Snort.conf file logging to MySQL and then displaying in ACID. The problem is that I cannot see any entries in MySQL, and thus, nothing is showing in ACID. I created a test.rules file and used "alert tcp any any -> any any..." and saved it in the rules folder. I then ran "snort -c test.rules" and nothing happened (this ran cleanly, BTW). You may think that there might be a problem with Snort not logging to MySQL, but one time (and one time only) I ran a "snort -c /etc/snort/snort.conf" and then ctrl-c'd a little while later. RIGHT when I did so, my ACID page logged 3 UDP packets. The signatures read "[snort] SCAN UPnP service discover attempt" on UDP 1900. There are 3 identical entries sourcing from the Host Computer (XP) IP address. I couldn't tell if it was a result of quitting Snort or if it was just before I quit. It could also be unrelated...dunno. Since then, however, I have never seen any more packets being logged. Can you help me, please? I would be eternally grateful. Please let me know what output I can copy and paste for you to see. Thanks, Ed
Current thread:
- Problems running Snort Edward Sohn (Oct 21)