Snort mailing list archives
Re: real-time alerting and rule to monitor only specific traffic
From: "Al Lewis (allewi)" <allewi () cisco com>
Date: Tue, 24 Feb 2015 01:45:05 +0000
You can filter that out by applying a bpf filter to the end of your command. Below I filtered out port 80 traffic. Without the filter I get alerts but with the filter I don’t even though the rule is “any to any” inside the conf file. gecko:/var/tmp/snort-2.9.7.0-released # ./bin/snort -c etc/lena.conf -r etc/lena.pcap -A console:test -H -U -k none -q 1 1 1000001 0 2 1 1000001 0 3 1 1000001 0 gecko:/var/tmp/snort-2.9.7.0-released # ./bin/snort -c etc/lena.conf -r etc/lena.pcap -A console:test -H -U -k none -q not tcp port 80 gecko:/var/tmp/snort-2.9.7.0-released # gecko:/var/tmp/snort-2.9.7.0-released # tcpdump -n -r etc/lena.pcap -c 1 reading from file etc/lena.pcap, link-type EN10MB (Ethernet) 11:11:28.852742 IP 10.5.40.95.36884 > 10.4.31.42.80: Flags [S], seq 2514493807, win 5840, options [mss 1460,sackOK,TS val 347823238 ecr 0,nop,wscale 7], length 0 gecko:/var/tmp/snort-2.9.7.0-released # For the email alerts you can try sending messages to syslog and then emailing from there. Maybe someone else can chime in and help out with that. Hope this helps! Albert Lewis QA Software Engineer SOURCEfire, Inc. now part of Cisco 9780 Patuxent Woods Drive Columbia, MD 21046 Phone: (office) 443.430.7112 Email: allewi () cisco com From: Lena Okanovic [mailto:lokanovic () flightapps com] Sent: Monday, February 23, 2015 7:25 PM To: snort-users () lists sourceforge net Subject: [Snort-users] real-time alerting and rule to monitor only specific traffic Hello, How can I only monitor TCP traffic that is not on port 80 or 443 or on our DMZ IP address? And also, can someone please provide me with instructions on how to setup real-time (email) alerting in Snort on Windows server box. So, if 'bad' TCP traffic comes through, I would like to get an email right a way letting me know. Thank you, Lena Okanovic lokanovic () flightapps com<mailto:lokanovic () flightapps com>
------------------------------------------------------------------------------ Dive into the World of Parallel Programming The Go Parallel Website, sponsored by Intel and developed in partnership with Slashdot Media, is your hub for all things parallel software development, from weekly thought leadership blogs to news, videos, case studies, tutorials and more. Take a look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!
Current thread:
- real-time alerting and rule to monitor only specific traffic Lena Okanovic (Feb 23)
- Re: real-time alerting and rule to monitor only specific traffic Al Lewis (allewi) (Feb 23)
- Re: real-time alerting and rule to monitor only specific traffic Lena Okanovic (Feb 26)
- Re: real-time alerting and rule to monitor only specific traffic Al Lewis (allewi) (Feb 23)