Re: Blocked Verdicts vs. Alerts

["Russ Combs (rucombs)" <rucombs () cisco com>]

Do you have normalization enabled?  If so, what do those stats show?
________________________________________
From: Avery Rozar [Avery.Rozar () i-techsupport com]
Sent: Friday, March 07, 2014 2:07 PM
To: Joel Esler (jesler)
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] Blocked Verdicts vs. Alerts

Nope, I did a kill -USR1 pid and got these results back.

Action Stats:
Alerts:            0 (  0.000%)
Logged:            0 (  0.000%)
Passed:            0 (  0.000%)
Verdicts:
Allow:      8582762 ( 48.978%)
Block:         6846 (  0.039%)
Replace:           79 (  0.000%)
Whitelist:      8933993 ( 50.982%)
Blacklist:            0 (  0.000%)
Ignore:            0 (  0.000%)



Using pulled pork with VRT signatures.

Here is the config:

##Pulled pork
dropsid=/etc/snort/dropsid.conf
ips_policy=Balanced

##/etc/snort/dropsid.conf
pcre:security-ips\s*drop



On 3/7/14, 12:37 PM, "Joel Esler (jesler)" <jesler () cisco com> wrote:

> Depends on how you have it configured, but generally speaking, yes.  Are
> you not?
>
>
> On Mar 7, 2014, at 10:58 AM, Avery Rozar <Avery.Rozar () i-techsupport com>
> wrote:
>
> > How can I see info about what is blocked in ³Verdicts"? Shouldn¹t I see
> > Alerts if its blocking traffic?
> >
> > Action Stats:
> > Alerts:            0 (  0.000%)
> > Logged:            0 (  0.000%)
> > Passed:            0 (  0.000%)
> >
> > Verdicts:
> > Allow:      8582762 ( 48.978%)
> > Block:         6846 (  0.039%)
> > Replace:           79 (  0.000%)
> > Whitelist:      8933993 ( 50.982%)
> > Blacklist:            0 (  0.000%)
> > Ignore:            0 (  0.000%)
> >
> > Thanks,
> > Avery
> >
> >
> > -------------------------------------------------------------------------
> > -----
> > Subversion Kills Productivity. Get off Subversion & Make the Move to
> > Perforce.
> > With Perforce, you get hassle-free workflows. Merge that actually
> > works.
> > Faster operations. Version large binaries.  Built-in WAN optimization
> > and the
> > freedom to use Git, Perforce or both. Make the move to Perforce.
> >
> > http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clk
> > trk
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> > Snort news!


------------------------------------------------------------------------------
Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce.
With Perforce, you get hassle-free workflows. Merge that actually works.
Faster operations. Version large binaries.  Built-in WAN optimization and the
freedom to use Git, Perforce or both. Make the move to Perforce.
http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------
Subversion Kills Productivity. Get off Subversion & Make the Move to Perforce.
With Perforce, you get hassle-free workflows. Merge that actually works. 
Faster operations. Version large binaries.  Built-in WAN optimization and the
freedom to use Git, Perforce or both. Make the move to Perforce.
http://pubads.g.doubleclick.net/gampad/clk?id=122218951&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!