Re: Snort not generating alerts

[wkitty42--- via Snort-users <snort-users () lists snort org>]

On 10/12/19 7:22 PM, bobby via Snort-users wrote:
> I am running Snort on a Ubuntu 16 server.  I made sure my interface is in 
> promiscuous mode.  I've also tested the configuration file, and it returned 
> fine.  I tested with local.rules, for ICMP alerts, which works file.  But when 
> Snort is running, no alerts are generated otherwise.  I went through my rules, 
> and I have over 80,000 rules active.  I am not sure if this matters, but they 
> are set to 'drop'.
> Please advise.  Thank you.


have you tried adding "-k none" to your snort command line?

you might also want to disable all offloading of tasks to your NIC or other 
cards so that snort can perform those offloaded tasks itself...


--
 NOTE: No off-list assistance is given without prior approval.
       *Please keep mailing list traffic on the list unless*
       *a signed and pre-paid contract is in effect with us.*
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette