Snort mailing list archives
Re: BASE 100% TCP ?
From: Joao Daniel Neves <joaodanielnevesss () hotmail com>
Date: Wed, 13 Mar 2013 20:57:43 +0300
Hi, I have decided to "goback" a few steps. I ran: /usr/local/bin/snort -D -i eth1 -h 192.168.1.0/24 -u snort -g snort -l /tmp/log/log.log -c /etc/snort/snort.conf Then: tail -f /tmp/log/log.log I did not saw anything. (And I did not got any UDP traffic on BASE GUI) But if I ran: /usr/local/bin/snort -i eth1 -h 192.168.1.0/24 -u snort -g snort -l /tmp/log/log.log -c /etc/snort/snort.conf (without -D (daemon option). I got this output (snip to smooth): ================================================= Snort processed 43744 packets. Pkts/min: 43744 Pkts/sec: 672 S5: Pruned session from cache that was using 1137906 bytes (purge whole cache). ================================ Packet I/O Totals: Received: 43744 Analyzed: 43744 (100.000%) Dropped: 0 ( 0.000%) Filtered: 0 ( 0.000%) Outstanding: 0 ( 0.000%) Injected: 0 . . . SNIP ================================= Breakdown by protocol (includes rebuilt packets): Eth: 43804 (100.000%) VLAN: 0 ( 0.000%) IP4: 43739 ( 99.852%) Frag: 0 ( 0.000%) ICMP: 2516 ( 5.744%) UDP: 17126 ( 39.097%) TCP: 23695 ( 54.093%) IP6: 0 ( 0.000%) ================================= . . . SNIP ================================= Action Stats: Alerts: 10 Logged: 10 Passed: 0 ================================= Facts/Points: Acording with it I have UDP traffic. If I run a port scan against Snort, Snort detects it as you can see ( Alerts: 10 ) As far as I know I'm not using BPF I really don't know what is happening. Additional info: tcpdump -i eth0 -nn udp show a lot of packages. Sorry I did not understood it "If you run a tcpdump across the interface, does it look 'firehose-y' to you? If you pull that output into Wireshark, how does it look?" Subject: Re: [Snort-users] BASE 100% TCP ? From: mike () millertwinracing com Date: Tue, 12 Mar 2013 12:47:28 -0600 CC: snort-users () lists sourceforge net To: joaodanielnevesss () hotmail com I've seen similar behavior when using a spanport on a core switch that wasn't properly configured and/or the interface isn't in promiscuous mode. If you run a tcpdump across the interface, does it look 'firehose-y' to you? If you pull that output into Wireshark, how does it look? On Mar 12, 2013, at 6:59 AM, Joao Daniel Neves <joaodanielnevesss () hotmail com> wrote:Snort Enthusiasts, I have deployed a Snort with BASE as a GUI. I have attached the BASE Main screen on this e-mail. If you cant see this jpg I have also upload to this site http://servicos.cafecomchips.com.br/Novo/Upload/Exibir_Foto.php?foto=b34243fef3.png My doubt is about something in base main screen. As you can see all my traffic is TCP, I haven't any alerts for port scanner. Or even I don't have any UDP traffic what is very stranger since there are DNS query going out the interface that snort is listenning. What can explaint it? Further more I have ran port scanner against this snort and it seems that it did not catch it* *This snort was deployed on a Firewall machine and I ran the port scanner in the same interface that snort is listenning, from a outside machine. <snortisitnormal.png>------------------------------------------------------------------------------ Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester Wave(TM): Endpoint Security, Q1 2013 and "remains a good choice" in the endpoint security space. For insight on selecting the right partner to tackle endpoint security challenges, access the full report. http://p.sf.net/sfu/symantec-dev2dev_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_d2d_mar
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- BASE 100% TCP ? Joao Daniel Neves (Mar 12)
- Re: BASE 100% TCP ? Jeremy Hoel (Mar 12)
- Re: BASE 100% TCP ? Mike Miller (Mar 12)
- Re: BASE 100% TCP ? Joao Daniel Neves (Mar 13)