Has the self-test function changed in Snort 2.4.0? It doesn't seem to
be catching bad rule syntax, etc.
I deliberately inserted a bad rule in web-misc.rules:
# Deliberate INVALID RULE (missing source port) to see if snort
-T (validatation mode) catches it
alert tcp 165.199.0.0/16 -> any any ( msg:"VALIDATION TEST" ;
classtype=not-suspicious; rev:1;)
Snort 2.4.0 didn't catch the bad rule:
bin/snort -c snort.conf -T
***
*** interface device lookup found: eth0
***
Running in Test mode with config file: snort.conf
--== Initializing Snort ==--
Initializing Output Plugins!
Decoding LoopBack on interface eth0
--== Initialization Complete ==--
,,_ -*> Snort! <*-
o" )~ Version 2.4.0 (Build 18)
'''' By Martin Roesch & The Snort Team:
http://www.snort.org/team.html
(C) Copyright 1998-2005 Sourcefire Inc., et al.
Snort sucessfully loaded all rules and checked all rule chains!
Snort exiting
Snort 2.3.3 catches it, plus it displays a lot more diagnostic info:
bin/snort.2.3.3 -c snort.conf-2.3.3 -T
Running in IDS mode
Initializing Network Interface eth0
--== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
Parsing Rules file snort.conf-2.3.3
+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
[... a lot more info snipped ...]
ERROR: Warning: ./rules/local/local.rules(215) => Unknown
keyword ' resp' in rule!
Fatal Error, Quitting..
Both config files specify the same rule path and include web-misc.rules
( I tried absolute paths, too):
snort.conf:var RULE_PATH ./rules
snort.conf:include $RULE_PATH/web-misc.rules
snort.conf-2.3.3:var RULE_PATH ./rules
snort.conf-2.3.3:include $RULE_PATH/web-misc.rules
I tried adding the -v (verbose) switch to the 2.4.0 line, but that
didn't help.
If I try to start snort in normal mode with the bad rule still in place,
2.4.0 DOES report the bad rule and dies. Once I correct the rule, it
runs correctly.
I also tried including a non-existent rule file in the 2.4.0 config
file, and self-test didn't catch that, either.
Did I miss a build switch? I used this configure statement:
./configure --with-snmp --with-mysql --exec-prefix=/usr/local/snort
--enable-flexresp
Thanks for any assistance.
- Brian
-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
