I've seen one or two posts on the net with someone having the same
problem that I am experiencing, but no replies. So hopefully I have
better luck here! :)
I have installed Snort version 2.4.3 on a Windows XP Professional box
and can not seem to get it to alert. I have also installed Ethereal
version 0.10.14 which installs WinPcap version 3.1.
I can start Snort from a command line by typing the following from the
C:\Snort\bin directory
"snort.exe -c "C:\Snort\etc\snort.conf" -K ascii -l "C:\Snort\log" -A
full -I 4 -d -e -X"
When I stop Snort, I can see in the statistics that Snort has seen
traffic and I can run Snort in verbose mode and watch packets fly by so
I'm confident that Snort is actually seeing the traffic that I am
sending, it's just not alerting on anything because when I go into the
C:\Snort\log directory, there's nothing there even though I have rules
enabled and put rules in the C:\Snort\rules directory.
Any thoughts? I can provide my snort.conf file. Can I send attachments
to the mailing list or do I have to paste the contents into the body?
--
Anthony Fischer
-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems? Stop! Download the new AJAX search engine that makes
searching your log files as easy as surfing the web. DOWNLOAD SPLUNK!
http://sel.as-us.falkag.net/sel?cmd_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
