Snort mailing list archives
Re: Fwd: Re: Suppress alerts
From: Peter Rodger <prodger2008 () yahoo com>
Date: Thu, 20 Oct 2005 06:59:47 -0700 (PDT)
Hi Thanks for your hint. The output had a error as I forgot to specify -l in comand line. The attached is the right output after I specified -l switch in command line. Here is the last part of output: +-----------------------[thresholding-config]---------------------------------- | memory-cap : 1048576 bytes +-----------------------[thresholding-global]---------------------------------- | none +-----------------------[thresholding-local]----------------------------------- | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds= 2 | gen-id=1 sig-id=3543 type=Threshold tracking=src count=5 seconds= 2 | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds= 2 | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds= 10 | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds= 60 | gen-id=1 sig-id=3542 type=Threshold tracking=src count=5 seconds= 2 | gen-id=1 sig-id=3527 type=Limit tracking=dst count=5 seconds= 60 +-----------------------[suppression]------------------------------------------ | gen-id=119 sig-id=4 tracking=dstip=0.0.0.0 mask=0.0.0.0 | gen-id=122 sig-id=27 tracking=dstip=0.0.0.0 mask=0.0.0.0 | gen-id=122 sig-id=19 tracking=dstip=0.0.0.0 mask=0.0.0.0 ***************** It looked like it reads the threshold.conf but can not suppress the alerts? Why? Any help will be appreciated. I am just too upset with that. Thanks, Peter --- João Mota <joao () 3gnt net> wrote:
Peter Rodger wrote:Hi, Thanks for your help. Sorry that I did not sendwholeoutput to you. Please see the attched output.txtandthere is an error stopped in log directory. Cannotfigure out why? ERROR: [!] ERROR: Can not get write access to loggingdirectory "log".(directory doesn't exist or permissions are setincorrectlyor it is not a directory at all) Fatal Error, Quitting.. D:\win-ids\Snort\bin>Well... try to follow the instructions given. What's the output configuration line? Have you tried replacing the '\' with '/' or vice-versa in the logs path?Still get tons of open port alerts and desperately need your help.If Snort isn't starting how can you be getting alerts? When you figure out what's wrong with the output dir send the Snort's output concerning the thresholding. Good hunting :)
__________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com
D:\win-ids\Snort\bin>snort -c d:\win-ids\snort\etc\snort.conf -l d:\win-ids\snor t\log Running in IDS mode Initializing Network Interface \Device\NPF_{068F010E-6C94-4163-9C52-15551BFD66A9 } --== Initializing Snort ==-- Initializing Output Plugins! Decoding Ethernet on interface \Device\NPF_{068F010E-6C94-4163-9C52-15551BFD66A9 } Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file d:\win-ids\snort\etc\snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... ,-----------[Flow Config]---------------------- | Stats Interval: 0 | Hash Method: 2 | Memcap: 10485760 | Rows : 4099 | Overhead Bytes: 16400(%0.16) `---------------------------------------------- No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Self preservation threshold: 500 Self preservation period: 90 Suspend threshold: 1000 Suspend period: 30 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: INACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 State Protection: 0 Self preservation threshold: 50 Self preservation period: 90 Suspend threshold: 200 Suspend period: 30 Enforce TCP State: INACTIVE Midstream Drop Alerts: INACTIVE Stream4_reassemble config: Server reassembly: INACTIVE Client reassembly: ACTIVE Reassembler alerts: ACTIVE Zero out flushed packets: INACTIVE flush_data_diff_size: 500 Ports: 21 23 25 53 80 110 111 143 513 1433 Emergency Ports: 21 23 25 53 80 110 111 143 513 1433 HttpInspect Config: GLOBAL CONFIG Max Pipeline Requests: 0 Inspection Type: STATELESS Detect Proxy Usage: NO IIS Unicode Map Filename: d:\win-ids\snort\etc\unicode.map IIS Unicode Map Codepage: 1252 DEFAULT SERVER CONFIG: Ports: 80 8080 8180 Flow Depth: 300 Max Chunk Length: 500000 Inspect Pipeline Requests: YES URI Discovery Strict Mode: NO Allow Proxy Usage: NO Disable Alerting: NO Oversize Dir Length: 500 Only inspect URI: NO Ascii: YES alert: NO Double Decoding: YES alert: YES %U Encoding: YES alert: YES Bare Byte: YES alert: YES Base36: OFF UTF 8: OFF IIS Unicode: YES alert: YES Multiple Slash: YES alert: NO IIS Backslash: YES alert: NO Directory Traversal: YES alert: NO Web Root Traversal: YES alert: YES Apache WhiteSpace: YES alert: NO IIS Delimiter: YES alert: NO IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG Non-RFC Compliant Characters: NONE rpc_decode arguments: Ports to decode RPC on: 111 32771 alert_fragments: INACTIVE alert_large_fragments: ACTIVE alert_incomplete: ACTIVE alert_multiple_requests: ACTIVE telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 Portscan Detection Config: Detect Protocols: TCP UDP ICMP IP Detect Scan Type: portscan portsweep decoy_portscan distributed_portscan Sensitivity Level: Low Memcap (in bytes): 10000000 Number of Nodes: 36900 Using LOCAL time alert_syslog output processor is defaulting to syslog server on 127.0.0.1 port 5 14! database: compiled support for ( mysql odbc mssql ) database: configured to use mssql database: database name = snort database: user = snort database: password is set database: host = localhost database: port = 1433 database: sensor name = TESTIDS:\Device\NPF_{068F010E-6C94-4163-9C52-15551BFD6 6A9} database: SQL Server message 5701, state 2, severity 0: Changed database context to 'snort'. Server 'TESTIDS', database: SQL Server message 5701, state 1, severity 0: Changed database context to 'snort'. Server 'TESTIDS', Line 1 database: sensor id = 1 database: inconsistent cid information for sid=1 Recovering by rolling forward the cid=38534 database: schema version = 106 database: using the "log" facility database: compiled support for ( mysql odbc mssql ) database: configured to use mssql database: database name = snort database: user = snort database: password is set database: host = localhost database: port = 1433 database: sensor name = TESTIDS:\Device\NPF_{068F010E-6C94-4163-9C52-15551BFD6 6A9} database: SQL Server message 5701, state 2, severity 0: Changed database context to 'snort'. Server 'TESTIDS', database: SQL Server message 5701, state 1, severity 0: Changed database context to 'snort'. Server 'TESTIDS', Line 1 database: sensor id = 1 database: schema version = 106 database: using the "alert" facility 2111 Snort rules read... 2111 Option Chains linked into 191 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set. Warning: flowbits key 'realplayer.playlist' is checked but not ever set. Warning: flowbits key 'http.jpeg' is checked but not ever set. +-----------------------[thresholding-config]---------------------------------- | memory-cap : 1048576 bytes +-----------------------[thresholding-global]---------------------------------- | none +-----------------------[thresholding-local]----------------------------------- | gen-id=1 sig-id=3273 type=Threshold tracking=src count=5 seconds= 2 | gen-id=1 sig-id=3543 type=Threshold tracking=src count=5 seconds= 2 | gen-id=1 sig-id=3152 type=Threshold tracking=src count=5 seconds= 2 | gen-id=1 sig-id=2523 type=Both tracking=dst count=10 seconds= 10 | gen-id=1 sig-id=2275 type=Threshold tracking=dst count=5 seconds= 60 | gen-id=1 sig-id=3542 type=Threshold tracking=src count=5 seconds= 2 | gen-id=1 sig-id=3527 type=Limit tracking=dst count=5 seconds= 60 +-----------------------[suppression]------------------------------------------ | gen-id=119 sig-id=4 tracking=dstip=0.0.0.0 mask=0.0.0.0 | gen-id=122 sig-id=27 tracking=dstip=0.0.0.0 mask=0.0.0.0 | gen-id=122 sig-id=19 tracking=dstip=0.0.0.0 mask=0.0.0.0 +------------------------------------------------------------------------------ Rule application order: ->activation->dynamic->alert->pass->log Log directory = d:\win-ids\snort\log --== Initialization Complete ==-- ,,_ -*> Snort! <*- o" )~ Version 2.3.0-ODBC-MySQL-MSSQL-FlexRESP-WIN32 (Build 10) '''' By Martin Roesch & The Snort Team: http://www.snort.org/team.html (C) Copyright 1998-2004 Sourcefire Inc., et al.
Current thread:
- Re: Suppress alerts, (continued)
- Re: Suppress alerts Joel Esler (Oct 18)
- Re: Suppress alerts Peter Rodger (Oct 18)
- Re: Suppress alerts Frank Knobbe (Oct 18)
- Re: Suppress alerts Joel Esler (Oct 18)
- Re: Fwd: Re: Suppress alerts João Mota (Oct 18)
- Re: Fwd: Re: Suppress alerts Peter Rodger (Oct 18)
- RE: Fwd: Re: Suppress alerts Patrick Harper (Oct 18)
- RE: Fwd: Re: Suppress alerts Peter Rodger (Oct 18)
- Re: Fwd: Re: Suppress alerts João Mota (Oct 19)
- Re: Fwd: Re: Suppress alerts Peter Rodger (Oct 19)
- Re: Fwd: Re: Suppress alerts Peter Rodger (Oct 19)
- Re: Fwd: Re: Suppress alerts João Mota (Oct 20)