Snort mailing list archives
Re: Network Variables
From: "Seth Dunn" <seth () d2ms com>
Date: Wed, 1 May 2013 13:09:46 -0400
Ok, that is what I was thinking. Now my bpf file, I initially did this: not net 10.10.0.0/24 and not net 10.30.0.0/24 And that appears to work....snort started, and I didn't get alerts...maybe the users didn't do anything to trigger the alerts, who knows. So I wanted to tighten it up to make it a bit more specific. So I wanted to comment the line: # not net 10.10.0.0/24 and not net 10.30.0.0/24 and add in this one: not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80 So if I do that, then snort fails to start, it has problems with the bpf file....it will not let me comment lines, so I can't add descriptions. So I deleted the first line and left in: not net 10.10.0.0/24 and dst host 10.75.45.1 && dst port 80 or not net 10.30.0.0/24 and dst host 10.75.45.1 && dst port 80 Snort again starts and runs, and so far has not generated alerts...but again, the users may have just not done anything to generate the alerts. So I will watch it for the next day and see what happens. But any ideas why snort fails to start if I add in a '#' to comment a line?? -----Original Message----- From: waldo kitty [mailto:wkitty42 () windstream net] Sent: Wednesday, May 01, 2013 11:49 AM To: snort-users () lists sourceforge net Subject: Re: [Snort-users] Network Variables On 5/1/2013 11:11, Seth Dunn wrote:
Do you have to use the -F switch to call the bpf file, or can you just
configure in the snort.conf file to use it and the bpf file is processed?
it should work the same either way... if it does not, it may be a bug... joel or someone on the dev team may be able to answer that question... FWIW: my understanding is that command line switches override conf file entries... -- NOTE: No off-list assistance is given without prior approval. Please keep mailing list traffic on the list unless private contact is specifically requested and granted. ------------------------------------------------------------------------ ------ Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET Get 100% visibility into your production application - at no cost. Code-level diagnostics for performance bottlenecks with <2% overhead Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap1 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news! ------------------------------------------------------------------------------ Introducing AppDynamics Lite, a free troubleshooting tool for Java/.NET Get 100% visibility into your production application - at no cost. Code-level diagnostics for performance bottlenecks with <2% overhead Download for free and get started troubleshooting in minutes. http://p.sf.net/sfu/appdyn_d2d_ap1 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- Re: Network Variables, (continued)
- Re: Network Variables Jeremy Hoel (Apr 30)
- Re: Network Variables Seth Dunn (Apr 30)
- Re: Network Variables Jeremy Hoel (Apr 30)
- Re: Network Variables Seth Dunn (Apr 30)
- Re: Network Variables waldo kitty (Apr 30)
- Re: Network Variables Seth Dunn (Apr 30)
- Re: Network Variables Michael Green (Apr 30)
- Re: Network Variables Seth Dunn (May 01)
- Re: Network Variables Seth Dunn (May 01)
- Re: Network Variables waldo kitty (May 01)
- Re: Network Variables Seth Dunn (May 01)
- Re: Network Variables waldo kitty (May 01)
- Re: Network Variables Russ Combs (May 01)
- Re: Network Variables Seth Dunn (May 02)
- Re: Network Variables James Lay (May 02)
- Re: Network Variables Seth Dunn (May 02)
- Re: Network Variables Seth Dunn (May 02)
- Re: Network Variables James Lay (May 02)
- Re: Network Variables Seth Dunn (May 02)
- Re: Network Variables James Lay (May 02)
- Re: Network Variables Seth Dunn (May 02)
- Re: Network Variables Jeremy Hoel (Apr 30)