Re: [Snort-users] catching some alerts, but NOT consistent

I should add that pipe -i2 -v into find "3389" will detect the connection 
traffic. Its strange and I cannot get snort to alert for the life of me

-----Original Message-----
From: Jason Brvenik [mailto:jasonb@sourcefire.com] 
Sent: Sunday, September 16, 2007 8:44 PM
To: Casiano, Jason (Sys Admin)
Cc: snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] catching some alerts, but NOT consistent



Casiano, Jason (Sys Admin) wrote:
> broadcom BCM5708C
>
> Winsrv2k3 wsp2
>
> Winpcap 401
>
> Snort exec= -cc:\snort\etc\snort.conf âld:\logs\snort âKascii âi2
>
>  
>
> im using a terminal service request alert to verify snort functionality
> on my servers, however ive got a couple using the broadcom BCM5708C
> netextreme 2 adapters that dont seem to report on a term server request,
> however icmp request report just dandy.
>
> any ideas? i truly would like to iron this out, ive been pulling my hair
> our for 3 weeks now.
>
>  

My first guess because of ICMP / Non ICMP is going to be checksum
issues. What happens when you run snort adding -k none?
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users