Snort mailing list archives
Re: help with rules - data capturing
From: "Will Metcalf" <william.metcalf () gmail com>
Date: Wed, 26 Dec 2007 22:48:12 -0600
are you sending port 13001 traffic to the QUEUE target in iptables? -Q tells snort to read from ipqueue instead of listen on an interface. So if you intend to QUEUE traffic something like iptables -I FORWARD -p tcp --sport 13001 -j QUEUE iptables -I FORWARD -p tcp --dport 13001 -j QUEUE or if local to the box iptables -I INPUT -p tcp --dport 13001 -j QUEUE iptables -I OUTPUT -p tcp --sport 13001 -j QUEUE or if you don't want to be inline just replace -Q with -i eth0 or whatever interface you want to listen on On Dec 26, 2007 6:29 PM, Timothy Ding <iolabs () gmail com> wrote:
Thank you all for responding, I compiled 2.81 and see snort running however i could use more help as no data were captured although i see the data from tcpdump with the same machine. I also try removing all the default rules running snort with only 1 to avoid any contaminations. perhaps i missed something? ~ Tim alert tcp any any -> $HOME_NET 13001 (msg: "GPRMC found in packet"; \ flow:to_server,established; content:"|24|GPRMC"; nocase; sid:9999000;) TCPDUMP results 16:26:09.941940 IP 209.31.36.15.ptr.us.xo.net.13001 > 66.xxx.xxx.xxx.static.xxx.com.26334: S 664514795:664514795(0) ack 6516 win 5840 <mss 1460> 0x0000: 4500 002c 0000 4000 4006 7202 d11f 240f E..,..@.@.r...$. 0x0010: 42d8 90c3 32c9 66de 279b b0eb 0000 1974 B...2.f.'......t 0x0020: 6012 16d0 2cda 0000 0204 05b4 `...,....... 16:26:11.264892 IP 66.216.144.195.static.dejazzd.com.26334 > 209.xxx.xxx.xxx.ptr.xxx.net.13001: P 1:137(136) ack 1 win 8096 0x0000: 4500 00b0 0004 4000 eb06 c679 42d8 90c3 E..... () yB... 0x0010: d11f 240f 66de 32c9 0000 1974 279b b0ec ..$.f.2....t'... 0x0020: 5018 1fa0 8f42 0000 0604 8319 8800 0000 P....B.......... 0x0030: 6100 0000 2533 3536 3933 3930 3130 3030 a...%35693901000 0x0040: 3036 3736 2c24 4750 524d 432c 3030 3137 0676,$GPRMC,0017 0x0050: 3432 2e30 3030 2c41 2c33 3335 372e 3631 42.000,A,3357.61 0x0060: 3638 2c4e 2c31 3137 3536 2e38 3639 362c 68,N, 11756.8696, 0x0070: 572c 302e 3030 2c2c 3237 3132 3037 2c2c W,0.00,,271207,, 0x0080: 2c41 2c2b 3132 3133 3833 3936 3635 332c ,A,+12138396653, 0x0090: 4e30 3338 6400 0000 0000 0000 0000 0000 N038d........... 0x00a0: 0000 0000 0000 0000 0000 0000 ffff ffff ................ 16:26:11.264922 IP 209.31.36.15.ptr.us.xo.net.13001 > 66.xxx.xxx.xxx.static.xxx.com.26334: . ack 137 win 6432 0x0000: 4500 0028 9c41 4000 4006 d5c4 d11f 240f E..(.A@.@.....$. 0x0010: 42d8 90c3 32c9 66de 279b b0ec 0000 19fc B...2.f.'....... 0x0020: 5010 1920 41bf 0000 P...A... Snort started with this command. 46480 29072 ? S Dec24 2:05 /home/user1/snort/snort- 2.8.0.1/src/snort -Qc /home/user1/snort/snort-2.8.0.1/etc/snort.conf -l /var/log/snort/ ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- help with rules - data capturing Timothy Ding (Dec 21)
- Re: help with rules - data capturing Paul Melson (Dec 21)
- Re: help with rules - data capturing Timothy Ding (Dec 21)
- Re: help with rules - data capturing Joel Esler (Dec 21)
- Re: help with rules - data capturing Paul Melson (Dec 23)
- Re: help with rules - data capturing Timothy Ding (Dec 26)
- Re: help with rules - data capturing Will Metcalf (Dec 26)
- Re: help with rules - data capturing Timothy Ding (Dec 21)
- Re: help with rules - data capturing Paul Melson (Dec 21)