Hi All,
is there any way to tell how many rules are being loaded into snort when I
run it as a daemon by taking a look at the /var/log/messages file?
I have run the test of my config with "snort -c /etc/snort/snort.conf -i
eth1 -T" and it shows that the number of rules loaded is right but when I
run it as a daemon with "snort -c /etc/snort/snort.conf -i eth1 -D" it is
only alerting on stuff for the preprocessors.
I am running this on SlackWare 10.2 using two interfaces, eth0 is my
management interface and eth1 is my "snort" interface. It is running
ShoreWall as a firewall but I don't think that makes a difference.
Interface eth1 does not have an IP address associated with it and it is up
eth1 Link encap:Ethernet HWaddr <Some Address>
inet6 addr: <Some Address>/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:20730667 errors:0 dropped:0 overruns:0 frame:0
TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:8454877656 (8063.1 Mb) TX bytes:222 (222.0 b)
Interrupt:201
I have even tried enabling the "In Line" mode to circumvent any problems
that the firewall may be causing to no avail.
When I run a tcpdump -i eth1 the kernel drops almost all the packets, so I
am not sure if the packets are even getting to the interface.
tcpdump -i eth1
17 packets captured
772 packets received by filter
591 packets dropped by kernel
I know that I must be missing something but I can't figure out what gives.
Attached is my snort.conf with changes to protect the guilty.
Thanks
Felix
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
