On Sat, 19 Nov 2005 10:45:49 -0500
Jeff Kell <jeff-kell@utc.edu> wrote:
Vanja Hrustic wrote:
Is the Cat4500 port set as a monitor destination? For a 4500 you
need a monitor session setup properly, and you need to insure that
the session includes the traffic you are trying to snort. Typically
this is the switch uplink. For example, if your uplink is on gig1/1
and your eth1 is connected to gig2/24, you need something like:
monitor session 1 source interface Gi1/1
monitor session 1 destination interface Gi2/21
Not in the office right now, but I think it was setup in this way
(another guy set it up, so I'm not 100% sure).
That will get you copies of traffic over the uplink, but of course it
will not see traffic between ports on the same switch unless you're
monitoring an SVI or vlan that includes that traffic. You didn't
give details about your setup, but it certainly sounds like the
monitor session is incorrect.
I do monitor uplink, and I do get all the traffic, but I'll check the
exact setup tomorrow. Thanks for the details anyway.
You don't have stream reassembly enabled in your configuration.
You're also using "flow:" keywords in some of your rules, yet your
flow preprocessor configuration is commented out. Consequently,
flow: won't work.
<snip>
Again, you don't have flow enabled.
<snip>
The 2nd rule doesn't use flow. And you typing 'console' during a
telnet session won't be reassembled, so it won't be seen in one
contiguous packet.
Yes, the pasted rules have preprocessors disabled, but that's just
AFTER I've tried every single combination. They were all enabled
before, and I was just disabling them one by one, in hope that
something will change.
Thanks anyway.
Vanja
-------------------------------------------------------
This SF.Net email is sponsored by the JBoss Inc. Get Certified Today
Register for a JBoss Training Course. Free Certification Exam
for All Training Attendees Through End of 2005. For more info visit:
http://ads.osdn.com/?ad_id=7628&alloc_id=16845&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
