Re: (no subject)

[Priya Agarwal <priyaiitmandi () gmail com>]

Subject: snort.conf unable to load rule from local.conf while testing. I
also forgot to write the subject.

On Fri, Oct 31, 2014 at 1:02 PM, Priya Agarwal <priyaiitmandi () gmail com>
wrote:

> didnt send the entire output.
>
> Here it is.
>
>
>     Running in Test mode
>
>             --== Initializing Snort ==--
>     Initializing Output Plugins!
>     Initializing Preprocessors!
>     Initializing Plug-ins!
>     Parsing Rules file "/etc/snort/snort.conf"
>     PortVar 'HTTP_PORTS' defined :  [ 80:81 311 383 591 593 901 1220 1414
> 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000:7001
> 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123
> 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091 9443 9999
> 11371 34443:34444 41080 50002 55555 ]
>     PortVar 'SHELLCODE_PORTS' defined :  [ 0:79 81:65535 ]
>     PortVar 'ORACLE_PORTS' defined :  [ 1024:65535 ]
>     PortVar 'SSH_PORTS' defined :  [ 22 ]
>     PortVar 'FTP_PORTS' defined :  [ 21 2100 3535 ]
>     PortVar 'SIP_PORTS' defined :  [ 5060:5061 5600 ]
>     PortVar 'FILE_DATA_PORTS' defined :  [ 80:81 110 143 311 383 591 593
> 901 1220 1414 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988
> 7000:7001 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090
> 8118 8123 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091
> 9443 9999 11371 34443:34444 41080 50002 55555 ]
>     PortVar 'GTP_PORTS' defined :  [ 2123 2152 3386 ]
>     Detection:
>        Search-Method = AC-Full-Q
>         Split Any/Any group = enabled
>         Search-Method-Optimizations = enabled
>         Maximum pattern length = 20
>     Tagged Packet Limit: 256
>     Loading dynamic engine
> /usr/local/lib/snort_dynamicengine/libsf_engine.so... done
>
>     Loading all dynamic detection libs from
> /usr/local/lib/snort_dynamicrules...
>     WARNING: No dynamic libraries found in directory
> /usr/local/lib/snort_dynamicrules.
>       Finished Loading all dynamic detection libs from
> /usr/local/lib/snort_dynamicrules
>     Loading all dynamic preprocessor libs from
> /usr/local/lib/snort_dynamicpreprocessor/...
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_modbus_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_gtp_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_dnp3_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_reputation_preproc.so...
> done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_pop_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_imap_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_sip_preproc.so... done
>       Loading dynamic preprocessor library
> /usr/local/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... done
>       Finished Loading all dynamic preprocessor libs from
> /usr/local/lib/snort_dynamicpreprocessor/
>     Log directory = /var/log/snort
>     WARNING: ip4 normalizations disabled because not inline.
>     WARNING: tcp normalizations disabled because not inline.
>     WARNING: icmp4 normalizations disabled because not inline.
>     WARNING: ip6 normalizations disabled because not inline.
>     WARNING: icmp6 normalizations disabled because not inline.
>     Frag3 global config:
>         Max frags: 65536
>         Fragment memory cap: 4194304 bytes
>     Frag3 engine config:
>         Bound Address: default
>         Target-based policy: WINDOWS
>         Fragment timeout: 180 seconds
>         Fragment min_ttl:   1
>         Fragment Anomalies: Alert
>         Overlap Limit:     10
>         Min fragment Length:     100
>           Max Expected Streams: 768
>     Stream global config:
>         Track TCP sessions: ACTIVE
>         Max TCP sessions: 262144
>         TCP cache pruning timeout: 30 seconds
>         TCP cache nominal timeout: 3600 seconds
>         Memcap (for reassembly packet storage): 8388608
>         Track UDP sessions: ACTIVE
>         Max UDP sessions: 131072
>         UDP cache pruning timeout: 30 seconds
>         UDP cache nominal timeout: 180 seconds
>         Track ICMP sessions: INACTIVE
>         Track IP sessions: INACTIVE
>         Log info if session memory consumption exceeds 1048576
>         Send up to 2 active responses
>         Wait at least 5 seconds between responses
>         Protocol Aware Flushing: ACTIVE
>             Maximum Flush Point: 16000
>     Stream TCP Policy config:
>         Bound Address: default
>         Reassembly Policy: WINDOWS
>         Timeout: 180 seconds
>         Limit on TCP Overlaps: 10
>         Maximum number of bytes to queue per session: 1048576
>         Maximum number of segs to queue per session: 2621
>         Options:
>             Require 3-Way Handshake: YES
>             3-Way Handshake Timeout: 180
>             Detect Anomalies: YES
>         Reassembly Ports:
>           21 client (Footprint)
>           22 client (Footprint)
>           23 client (Footprint)
>           25 client (Footprint)
>           42 client (Footprint)
>           53 client (Footprint)
>           79 client (Footprint)
>           80 client (Footprint) server (Footprint)
>           81 client (Footprint) server (Footprint)
>           109 client (Footprint)
>           110 client (Footprint)
>           111 client (Footprint)
>           113 client (Footprint)
>           119 client (Footprint)
>           135 client (Footprint)
>           136 client (Footprint)
>           137 client (Footprint)
>           139 client (Footprint)
>           143 client (Footprint)
>           161 client (Footprint)
>           additional ports configured but not printed.
>     Stream UDP Policy config:
>         Timeout: 180 seconds
>     HttpInspect Config:
>         GLOBAL CONFIG
>           Detect Proxy Usage:       NO
>           IIS Unicode Map Filename: /etc/snort/unicode.map
>           IIS Unicode Map Codepage: 1252
>           Memcap used for logging URI and Hostname: 150994944
>           Max Gzip Memory: 838860
>           Max Gzip Sessions: 2723
>           Gzip Compress Depth: 65535
>           Gzip Decompress Depth: 65535
>         DEFAULT SERVER CONFIG:
>           Server profile: All
>           Ports (PAF): 80 81 311 383 591 593 901 1220 1414 1741 1830 2301
> 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000 7001 7144 7145 7510 7777
> 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123 8180 8181 8243 8280
> 8300 8800 8888 8899 9000 9060 9080 9090 9091 9443 9999 11371 34443 34444
> 41080 50002 55555
>           Server Flow Depth: 0
>           Client Flow Depth: 0
>           Max Chunk Length: 500000
>           Small Chunk Length Evasion: chunk size <= 10, threshold >= 5
> times
>           Max Header Field Length: 750
>           Max Number Header Fields: 100
>           Max Number of WhiteSpaces allowed with header folding: 200
>           Inspect Pipeline Requests: YES
>           URI Discovery Strict Mode: NO
>           Allow Proxy Usage: NO
>           Disable Alerting: NO
>           Oversize Dir Length: 500
>           Only inspect URI: NO
>           Normalize HTTP Headers: NO
>           Inspect HTTP Cookies: YES
>           Inspect HTTP Responses: YES
>           Extract Gzip from responses: YES
>           Decompress response files:
>           Unlimited decompression of gzip data from responses: YES
>           Normalize Javascripts in HTTP Responses: YES
>           Max Number of WhiteSpaces allowed with Javascript Obfuscation in
> HTTP responses: 200
>           Normalize HTTP Cookies: NO
>           Enable XFF and True Client IP: NO
>           Log HTTP URI data: NO
>           Log HTTP Hostname data: NO
>           Extended ASCII code support in URI: NO
>           Ascii: YES alert: NO
>           Double Decoding: YES alert: NO
>           %U Encoding: YES alert: YES
>           Bare Byte: YES alert: NO
>           UTF 8: YES alert: NO
>           IIS Unicode: YES alert: NO
>           Multiple Slash: YES alert: NO
>           IIS Backslash: YES alert: NO
>           Directory Traversal: YES alert: NO
>           Web Root Traversal: YES alert: NO
>           Apache WhiteSpace: YES alert: NO
>           IIS Delimiter: YES alert: NO
>           IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
>           Non-RFC Compliant Characters: 0x00 0x01 0x02 0x03 0x04 0x05 0x06
> 0x07
>           Whitespace Characters: 0x09 0x0b 0x0c 0x0d
>     rpc_decode arguments:
>         Ports to decode RPC on: 111 32770 32771 32772 32773 32774 32775
> 32776 32777 32778 32779
>         alert_fragments: INACTIVE
>         alert_large_fragments: INACTIVE
>         alert_incomplete: INACTIVE
>         alert_multiple_requests: INACTIVE
>     FTPTelnet Config:
>         GLOBAL CONFIG
>           Inspection Type: stateful
>           Check for Encrypted Traffic: YES alert: NO
>           Continue to check encrypted data: YES
>         TELNET CONFIG:
>           Ports: 23
>           Are You There Threshold: 20
>           Normalize: YES
>           Detect Anomalies: YES
>         FTP CONFIG:
>           FTP Server: default
>             Ports (PAF): 21 2100 3535
>             Check for Telnet Cmds: YES alert: YES
>             Ignore Telnet Cmd Operations: YES alert: YES
>             Ignore open data channels: NO
>           FTP Client: default
>             Check for Bounce Attacks: YES alert: YES
>             Check for Telnet Cmds: YES alert: YES
>             Ignore Telnet Cmd Operations: YES alert: YES
>             Max Response Length: 256
>     SMTP Config:
>         Ports: 25 465 587 691
>         Inspection Type: Stateful
>         Normalize: ATRN AUTH BDAT DATA DEBUG EHLO EMAL ESAM ESND ESOM ETRN
> EVFY EXPN HELO HELP IDENT MAIL NOOP ONEX QUEU QUIT RCPT RSET SAML SEND
> STARTTLS SOML TICK TIME TURN TURNME VERB VRFY X-EXPS XADR XAUTH XCIR
> XEXCH50 XGEN XLICENSE X-LINK2STATE XQUE XSTA XTRN XUSR CHUNKING X-ADAT
> X-DRCP X-ERCP X-EXCH50
>         Ignore Data: No
>         Ignore TLS Data: No
>         Ignore SMTP Alerts: No
>         Max Command Line Length: 512
>         Max Specific Command Line Length:
>            ATRN:255 AUTH:246 BDAT:255 DATA:246 DEBUG:255
>            EHLO:500 EMAL:255 ESAM:255 ESND:255 ESOM:255
>            ETRN:246 EVFY:255 EXPN:255 HELO:500 HELP:500
>            IDENT:255 MAIL:260 NOOP:255 ONEX:246 QUEU:246
>            QUIT:246 RCPT:300 RSET:246 SAML:246 SEND:246
>            SIZE:255 STARTTLS:246 SOML:246 TICK:246 TIME:246
>            TURN:246 TURNME:246 VERB:246 VRFY:255 X-EXPS:246
>            XADR:246 XAUTH:246 XCIR:246 XEXCH50:246 XGEN:246
>            XLICENSE:246 X-LINK2STATE:246 XQUE:246 XSTA:246 XTRN:246
>            XUSR:246
>         Max Header Line Length: 1000
>         Max Response Line Length: 512
>         X-Link2State Alert: Yes
>         Drop on X-Link2State Alert: No
>         Alert on commands: None
>         Alert on unknown commands: No
>         SMTP Memcap: 838860
>         MIME Max Mem: 838860
>         Base64 Decoding: Enabled
>         Base64 Decoding Depth: Unlimited
>         Quoted-Printable Decoding: Enabled
>         Quoted-Printable Decoding Depth: Unlimited
>         Unix-to-Unix Decoding: Enabled
>         Unix-to-Unix Decoding Depth: Unlimited
>         Non-Encoded MIME attachment Extraction: Enabled
>         Non-Encoded MIME attachment Extraction Depth: Unlimited
>         Log Attachment filename: Enabled
>         Log MAIL FROM Address: Enabled
>         Log RCPT TO Addresses: Enabled
>         Log Email Headers: Enabled
>         Email Hdrs Log Depth: 1464
>     SSH config:
>         Autodetection: ENABLED
>         Challenge-Response Overflow Alert: ENABLED
>         SSH1 CRC32 Alert: ENABLED
>         Server Version String Overflow Alert: ENABLED
>         Protocol Mismatch Alert: ENABLED
>         Bad Message Direction Alert: DISABLED
>         Bad Payload Size Alert: DISABLED
>         Unrecognized Version Alert: DISABLED
>         Max Encrypted Packets: 20
>         Max Server Version String Length: 100
>         MaxClientBytes: 19600 (Default)
>         Ports:
>         22
>     DCE/RPC 2 Preprocessor Configuration
>       Global Configuration
>         DCE/RPC Defragmentation: Enabled
>         Memcap: 102400 KB
>         Events: co
>         SMB Fingerprint policy: Disabled
>       Server Default Configuration
>         Policy: WinXP
>         Detect ports (PAF)
>           SMB: 139 445
>           TCP: 135
>           UDP: 135
>           RPC over HTTP server: 593
>           RPC over HTTP proxy: None
>         Autodetect ports (PAF)
>           SMB: None
>           TCP: 1025-65535
>           UDP: 1025-65535
>           RPC over HTTP server: 1025-65535
>           RPC over HTTP proxy: None
>         Invalid SMB shares: C$ D$ ADMIN$
>         Maximum SMB command chaining: 3 commands
>         SMB file inspection: Disabled
>     DNS config:
>         DNS Client rdata txt Overflow Alert: ACTIVE
>         Obsolete DNS RR Types Alert: INACTIVE
>         Experimental DNS RR Types Alert: INACTIVE
>         Ports: 53
>     SSLPP config:
>         Encrypted packets: not inspected
>         Ports:
>           443      465      563      636      989
>           992      993      994      995     7801
>          7802     7900     7901     7902     7903
>          7904     7905     7906     7907     7908
>          7909     7910     7911     7912     7913
>          7914     7915     7916     7917     7918
>          7919     7920
>         Server side data is trusted
>         Maximum SSL Heartbeat length: 0
>     Sensitive Data preprocessor config:
>         Global Alert Threshold: 25
>         Masked Output: DISABLED
>     SIP config:
>         Max number of sessions: 40000
>         Max number of dialogs in a session: 4 (Default)
>         Status: ENABLED
>         Ignore media channel: DISABLED
>         Max URI length: 512
>         Max Call ID length: 80
>         Max Request name length: 20 (Default)
>         Max From length: 256 (Default)
>         Max To length: 256 (Default)
>         Max Via length: 1024 (Default)
>         Max Contact length: 512
>         Max Content length: 2048
>         Ports:
>         5060    5061    5600
>         Methods:
>           invite cancel ack bye register options refer subscribe update
> join info message notify benotify do qauth sprack publish service
> unsubscribe prack
>     IMAP Config:
>         Ports: 143
>         IMAP Memcap: 838860
>         MIME Max Mem: 838860
>         Base64 Decoding: Enabled
>         Base64 Decoding Depth: Unlimited
>         Quoted-Printable Decoding: Enabled
>         Quoted-Printable Decoding Depth: Unlimited
>         Unix-to-Unix Decoding: Enabled
>         Unix-to-Unix Decoding Depth: Unlimited
>         Non-Encoded MIME attachment Extraction: Enabled
>         Non-Encoded MIME attachment Extraction Depth: Unlimited
>     POP Config:
>         Ports: 110
>         POP Memcap: 838860
>         MIME Max Mem: 838860
>         Base64 Decoding: Enabled
>         Base64 Decoding Depth: Unlimited
>         Quoted-Printable Decoding: Enabled
>         Quoted-Printable Decoding Depth: Unlimited
>         Unix-to-Unix Decoding: Enabled
>         Unix-to-Unix Decoding Depth: Unlimited
>         Non-Encoded MIME attachment Extraction: Enabled
>         Non-Encoded MIME attachment Extraction Depth: Unlimited
>     Modbus config:
>         Ports:
>         502
>     DNP3 config:
>         Memcap: 262144
>         Check Link-Layer CRCs: ENABLED
>         Ports:
>         20000
>     Reputation config:
>     WARNING: Can't find any whitelist/blacklist entries. Reputation
> Preprocessor disabled.
>
>     +++++++++++++++++++++++++++++++++++++++++++++++++++
>     Initializing rule chains...
>     0 Snort rules read
>         0 detection rules
>         0 decoder rules
>         0 preprocessor rules
>     0 Option Chains linked into 0 Chain Headers
>     0 Dynamic rules
>     +++++++++++++++++++++++++++++++++++++++++++++++++++
>
>     +-------------------[Rule Port
> Counts]---------------------------------------
>     |             tcp     udp    icmp      ip
>     |     src       0       0       0       0
>     |     dst       0       0       0       0
>     |     any       0       0       0       0
>     |      nc       0       0       0       0
>     |     s+d       0       0       0       0
>
> +----------------------------------------------------------------------------
>
>
> +-----------------------[detection-filter-config]------------------------------
>     | memory-cap : 1048576 bytes
>
> +-----------------------[detection-filter-rules]-------------------------------
>     | none
>
> -------------------------------------------------------------------------------
>
>
> +-----------------------[rate-filter-config]-----------------------------------
>     | memory-cap : 1048576 bytes
>
> +-----------------------[rate-filter-rules]------------------------------------
>     | none
>
> -------------------------------------------------------------------------------
>
>
> +-----------------------[event-filter-config]----------------------------------
>     | memory-cap : 1048576 bytes
>
> +-----------------------[event-filter-global]----------------------------------
>
> +-----------------------[event-filter-local]-----------------------------------
>     | none
>
> +-----------------------[suppression]------------------------------------------
>     | none
>
> -------------------------------------------------------------------------------
>     Rule application order:
> activation->dynamic->pass->drop->sdrop->reject->alert->log
>     Verifying Preprocessor Configurations!
>
>             --== Initialization Complete ==--
>
>        ,,_     -*> Snort! <*-
>       o"  )~   Version 2.9.7.0 GRE (Build 149)
>        ''''    By Martin Roesch & The Snort Team:
> http://www.snort.org/contact#team
>                Copyright (C) 2014 Cisco and/or its affiliates. All rights
> reserved.
>                Copyright (C) 1998-2013 Sourcefire, Inc., et al.
>                Using libpcap version 1.1.1
>                Using PCRE version: 8.12 2011-01-15
>                Using ZLIB version: 1.2.3.4
>
>                Rules Engine: SF_SNORT_DETECTION_ENGINE  Version 2.4
> <Build 1>
>                Preprocessor Object: SF_FTPTELNET  Version 1.2  <Build 13>
>                Preprocessor Object: SF_SIP  Version 1.1  <Build 1>
>                Preprocessor Object: SF_IMAP  Version 1.0  <Build 1>
>                Preprocessor Object: SF_POP  Version 1.0  <Build 1>
>                Preprocessor Object: SF_REPUTATION  Version 1.1  <Build 1>
>                Preprocessor Object: SF_SDF  Version 1.1  <Build 1>
>                Preprocessor Object: SF_DNP3  Version 1.1  <Build 1>
>                Preprocessor Object: SF_SMTP  Version 1.1  <Build 9>
>                Preprocessor Object: SF_SSLPP  Version 1.1  <Build 4>
>                Preprocessor Object: SF_GTP  Version 1.1  <Build 1>
>                Preprocessor Object: SF_DNS  Version 1.1  <Build 4>
>                Preprocessor Object: SF_SSH  Version 1.1  <Build 3>
>                Preprocessor Object: SF_DCERPC2  Version 1.0  <Build 3>
>                Preprocessor Object: SF_MODBUS  Version 1.1  <Build 1>
>
>     Snort successfully validated the configuration!
>     Snort exiting
>
>
>
> On Fri, Oct 31, 2014 at 1:00 PM, Priya Agarwal <priyaiitmandi () gmail com>
> wrote:
>
> > I am following the 'Snort 2.9.6.2 on Ubuntu 12 LTS and 14 LTS' guide to
> > run snort in NIDS mode on my ubuntu 12.04.
> >
> > To test Snort, I created a simple rule that will cause Snort to generate
> > an alert whenever Snort sees an ICMP \Echo request" or \Echo reply"
> > messages.
> > Wrote the following line into the empty /etc/snort/rules/local.conf:
> >
> > alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001;
> > rev:001;)
> >
> > Now I tested the configuration file again but it has loaded the rule from
> > local.conf. Typed the following command:
> >
> > sudo snort -T -c /etc/snort/snort.conf
> >
> > I should have got the following output:
> >
> >     +-------------------[Rule Port Counts]-----------------------
> > ----------------
> >     |             tcp     udp    icmp      ip
> >     |     src       0       0       0       0
> >     |     dst       0       0       0       0
> >     |     any       0       0       1       0
> >     |      nc       0       0       1       0
> >     |     s+d       0       0       0       0
> >
> > +----------------------------------------------------------------------------
> >
> > But instead I got the following output on terminal.Both fields are still
> > 0.
> >
> >
> > --------------------------------------------------------------------------------
> >
> > Running in Test mode
> >
> >             --== Initializing Snort ==--
> >     Initializing Output Plugins!
> >     Initializing Preprocessors!
> >     Initializing Plug-ins!
> >     Parsing Rules file "/etc/snort/snort.conf"
> >     PortVar 'HTTP_PORTS' defined :  [ 80:81 311 383 591 593 901 1220 1414
> > 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000:7001
> > 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123
> > 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091 9443 9999
> > 11371 34443:34444 41080 50002 55555 ]
> >     PortVar 'SHELLCODE_PORTS' defined :  [ 0:79 81:65535 ]
> >     PortVar 'ORACLE_PORTS' defined :  [ 1024:65535 ]
> >     PortVar 'SSH_PORTS' defined :  [ 22 ]
> >     PortVar 'FTP_PORTS' defined :  [ 21 2100 3535 ]
> >     PortVar 'SIP_PORTS' defined :  [ 5060:5061 5600 ]
> >     PortVar 'FILE_DATA_PORTS' defined :  [ 80:81 110 143 311 383 591 593
> > 901 1220 1414 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988
> > 7000:7001 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090
> > 8118 8123 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091
> > 9443 9999 11371 34443:34444 41080 50002 55555 ]
> >     PortVar 'GTP_PORTS' defined :  [ 2123 2152 3386 ]
> >     Detection:
> >        Search-Method = AC-Full-Q
> >         Split Any/Any group = enabled
> >         Search-Method-Optimizations = enabled
> >         Maximum pattern length = 20
> >     Tagged Packet Limit: 256
> >     Loading dynamic engine /usr/local/lib/snort_
> > dynamicengine/libsf_engine.so... done
> >     Loading all dynamic detection libs from
> > /usr/local/lib/snort_dynamicrules...
> >     WARNING: No dynamic libraries found in directory
> > /usr/local/lib/snort_dynamicrules.
> >       Finished Loading all dynamic detection libs from
> > /usr/local/lib/snort_dynamicrules
> >     Loading all dynamic preprocessor libs from
> > /usr/local/lib/snort_dynamicpreprocessor/...
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_modbus_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_dce2_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_ssh_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_dns_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_gtp_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_ssl_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_smtp_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_dnp3_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_sdf_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_reputation_preproc.so...
> > done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_pop_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_imap_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_sip_preproc.so... done
> >       Loading dynamic preprocessor library
> > /usr/local/lib/snort_dynamicpreprocessor//libsf_ftptelnet_preproc.so... done
> >       Finished Loading all dynamic preprocessor libs from
> > /usr/local/lib/snort_dynamicpreprocessor/
> >     Log directory = /var/log/snort
> >     WARNING: ip4 normalizations disabled because not inline.
> >     WARNING: tcp normalizations disabled because not inline.
> >     WARNING: icmp4 normalizations disabled because not inline.
> >     WARNING: ip6 normalizations disabled because not inline.
> >     WARNING: icmp6 normalizations disabled because not inline.
> >     Frag3 global config:
> >         Max frags: 65536
> >         Fragment memory cap: 4194304 bytes
> >     Frag3 engine config:
> >         Bound Address: default
> >         Target-based policy: WINDOWS
> >         Fragment timeout: 180 seconds
> >         Fragment min_ttl:   1
> >         Fragment Anomalies: Alert
> >         Overlap Limit:     10
> >         Min fragment Length:     100
> >           Max Expected Streams: 768
> >     Stream global config:
> >         Track TCP sessions: ACTIVE
> >         Max TCP sessions: 262144
> >         TCP cache pruning timeout: 30 seconds
> >         TCP cache nominal timeout: 3600 seconds
> >         Memcap (for reassembly packet storage): 8388608
> >         Track UDP sessions: ACTIVE
> >         Max UDP sessions: 131072
> >         UDP cache pruning timeout: 30 seconds
> >         UDP cache nominal timeout: 180 seconds
> >         Track ICMP sessions: INACTIVE
> >         Track IP sessions: INACTIVE
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!