SnortSAM + Snort 2.3.3

[Xavier Cabrera <xavierc () devilcrack org>]

I have recently problems with Snort 2.3.3 and SnortSAM.

Snort can detect the attack but doesn't send the packet to SnortSAM 
machine.

What can be happend??

Previusly i made them work with previus releases.

Can anyone help me???

This its my INFO

###############################
### /var/log/messages##############
##############################

May  2 13:52:52 core snort: Initializing daemon mode
May  2 13:52:52 core snort: DEBUG => [Alert_FWsam](AlertFWsamSetup) 
Output plugin is plugged in...

!

May  2 13:52:53 core snort: command line overrides rules file alert plugin!
May  2 13:52:53 core snort:       IIS Unicode: YES alert: YES
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort:       Multiple Slash: YES alert: NO
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: 5minutes
May  2 13:52:53 core snort:       IIS Backslash: YES alert: NO
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort:       Directory Traversal: YES alert: NO
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,5minutes
May  2 13:52:53 core snort:       Web Root Traversal: YES alert: YES
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort:       Apache WhiteSpace: YES alert: NO
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,5minutes
May  2 13:52:53 core snort:       IIS Delimiter: YES alert: NO
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort:       IIS Unicode Map: GLOBAL IIS UNICODE 
MAP CONFIG
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,5minutes
May  2 13:52:53 core snort:       Non-RFC Compliant Characters: NONE
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort: rpc_decode arguments:
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,1minutes
May  2 13:52:53 core snort:     Ports to decode RPC on: 111 32771 
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort:     alert_fragments: INACTIVE
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,1minutes
May  2 13:52:53 core snort:     alert_large_fragments: ACTIVE
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort:     alert_incomplete: ACTIVE
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,1minutes
May  2 13:52:53 core snort:     alert_multiple_requests: ACTIVE
May  2 13:52:53 core snort: telnet_decode arguments:
May  2 13:52:53 core snort:     Ports to decode telnet on: 21 23 25 119 
May  2 13:52:53 core snort: Portscan Detection Config:
May  2 13:52:53 core snort:     Detect Protocols:  TCP UDP ICMP IP
May  2 13:52:53 core snort:     Detect Scan Type:  portscan portsweep 
decoy_portscan distributed_portscan
May  2 13:52:53 core snort:     Sensitivity Level: Low
May  2 13:52:53 core snort:     Memcap (in bytes): 10000000
May  2 13:52:53 core snort:     Number of Nodes:   36900
May  2 13:52:53 core snort: 
May  2 13:52:53 core snort: command line overrides rules file alert plugin!
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: 5minutes
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,5minutes
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,5minutes
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,5minutes
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,1minutes
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,1minutes
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
FWsamOptionInit is parsing...
May  2 13:52:53 core snort: DEBUG => [Alert_FWsam](AlertFWamOptionInit) 
Parse Options Args: src,1minutes


#########################################
######## /etc/snortsam/snortsam.conf   #########
########################################

defaultkey mypassword

port 898

accept 127.0.0.1/32, mypassword

bindip 127.0.0.1

########################################
#########/etc/snort/snort.conf   ##############
########################################

output alert_fwsam: 127.0.0.1:898/mypassword


#######################################
######## /var/log/eth0/alert  ###############
######################################

05/02-13:51:53.460764  [**] [1:499:4] ICMP Large ICMP Packet Protegida 
por SnortSAM 5 minutos [**] [Classification: Potentially Bad Traffic] 
[Priority: 2] {ICMP} x.y.z.10 -> a.b.c.1





-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.
Get your fingers limbered up and give it your best shot. 4 great events, 4
opportunities to win big! Highest score wins.NEC IT Guy Games. Play to
win an NEC 61 plasma display. Visit http://www.necitguy.com/?r=20
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users