Vanja Hrustic wrote:
eth1 interface is connected to Catalyst switch (45xx series). Port
monitoring works fine, and I can see all kinds of traffic on eth1. eth1
has no IP address assigned. Later on, I tried assigning an IP, but
nothing changed.
Is the Cat4500 port set as a monitor destination? For a 4500 you need a
monitor session setup properly, and you need to insure that the session
includes the traffic you are trying to snort. Typically this is the switch
uplink. For example, if your uplink is on gig1/1 and your eth1 is connected to
gig2/24, you need something like:
monitor session 1 source interface Gi1/1
monitor session 1 destination interface Gi2/21
That will get you copies of traffic over the uplink, but of course it will not see traffic between ports on the same switch unless you're monitoring an SVI or vlan that includes that traffic. You didn't give details about your setup, but it certainly sounds like the monitor session is incorrect.
Same is with telnet.rules. I try to login as root on a Solaris box, and
it nicely tells me "Not on system console". However, snort doesn't pick
it up.
You don't have stream reassembly enabled in your configuration. You're also using
"flow:" keywords in some of your rules, yet your flow preprocessor
configuration is commented out. Consequently, flow: won't work.
And no matter how many times I try to login as root to Solaris box, and
get "not on system console" message - it doesn't get picked up.
Again, you don't have flow enabled.
At the same time, some web traffic gets picked up, which contains
string "WebConsole.html", and triggers the 2nd rule. Then I connect to
port 25 on a server, and issue "expn console" - but it doesn't get
picked up. Nor logging as user 'console' on a telnet port gets picked
up.
The 2nd rule doesn't use flow. And you typing 'console' during a telnet
session won't be reassembled, so it won't be seen in one contiguous packet.
Jeff
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
