Re: snort-windows webserver-ec2

["Al Lewis (allewi)" <allewi () cisco com>]

Hello,

Sorry but can you explain “snort is not working in NIDS mode” a little more please?

Are you receiving an error? Are you not getting alerts? What rule isn’t working?

Thanks

Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112
Email: allewi () cisco com

From: Eugene Grama [mailto:eugene.grama () gmail com]
Sent: Wednesday, March 25, 2015 9:08 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] snort-windows webserver-ec2

Hello Team,

I have a Web Server Windows 2008 R2 instance EC2 (amazon)

Amazon, won't allow traffic monitoring (even in your own network). You will only get a traffic for that specific port, 
in where you are listening.

So I decided to install snort in the webserver itself so it can analyze traffic against its rule. But snort is not 
working as NIDS mode. Able to get packets in packet logger mode

I had test machine (but not in aws) and snort is working fine, i had imported my config file from test machine to 
production but still not working.

Also tried old version 2970 but still unable to make it work.

If you need any clarification, please tell me, needing any support
--
Thank you and Best regards,

Eugene

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. http://goparallel.sourceforge.net/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!