Snort mailing list archives
Number of rules in use?
From: snort () brainstomp com
Date: Wed, 30 Nov 2005 18:02:31 -0500 (EST)
Hi All, is there any way to tell how many rules are being loaded into snort when I run it as a daemon by taking a look at the /var/log/messages file? I have run the test of my config with "snort -c /etc/snort/snort.conf -i eth1 -T" and it shows that the number of rules loaded is right but when I run it as a daemon with "snort -c /etc/snort/snort.conf -i eth1 -D" it is only alerting on stuff for the preprocessors. I am running this on SlackWare 10.2 using two interfaces, eth0 is my management interface and eth1 is my "snort" interface. It is running ShoreWall as a firewall but I don't think that makes a difference. Interface eth1 does not have an IP address associated with it and it is up eth1 Link encap:Ethernet HWaddr <Some Address> inet6 addr: <Some Address>/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:20730667 errors:0 dropped:0 overruns:0 frame:0 TX packets:3 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:8454877656 (8063.1 Mb) TX bytes:222 (222.0 b) Interrupt:201 I have even tried enabling the "In Line" mode to circumvent any problems that the firewall may be causing to no avail. When I run a tcpdump -i eth1 the kernel drops almost all the packets, so I am not sure if the packets are even getting to the interface. tcpdump -i eth1 17 packets captured 772 packets received by filter 591 packets dropped by kernel I know that I must be missing something but I can't figure out what gives. Attached is my snort.conf with changes to protect the guilty. Thanks Felix ------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Do you grep through log files for problems? Stop! Download the new AJAX search engine that makes searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Number of rules in use? snort (Nov 30)