latest stable is 2.8.0.1. look it up. www.snort.org
you should compile snort anyway imnsho. why rely on a package that
someone put together. just compile snort and go with it.
On Dec 15, 2007 5:52 AM, Matteo Ignaccolo <matteo.ignaccolo@gmail.com> wrote:
Jonathan Askew JBASKEW wrote:
I am new to IDS and have just set up snort on a ubuntu host.
Which snort version?
On debian and debian based distros, as ubuntu, yuo will find only old
versions of snort.
For example, this summer on official ubuntu mirror was available
Snort 2.3.3, when the latest STABLE release was the 2.7
IMHO the best way to use snort on ubuntu is compile latest stable
release.
It has worked
well except for the fact that I am getting some false positivies
from local
traffic on the network.
Have you set the proper rules set for your network?
I want to set a rule in order to suppress/ignore local network
traffic for 192.168.1.0/24.
I know this can be done in the /etc/threshold.conf file but have
not been
able to do so successfully.
The correct solution is the tip in Boogie B. answer.
If I remember well, during installation you set your internal network
IP address and subnet, but the external net is sets to "any" as default
Remember that is not a good choice suppress all traffic from internal
host, because you'll be not able to detect anomaly activity that
starts from internal host.
--
Matteo Ignaccolo
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
