[Snort-users] Snort running but isnt reporting

Daniel van Balen vdaniel at ...191...
Sun Aug 6 08:35:55 EDT 2000


On Sun, Aug 06, 2000 at 03:56:23PM -0400, Robert Wright wrote:
> Hello,
> 	Im a new snort user, i installed snort, i have it running, im using
> vision.conf from whitehats.com as my rule set. However it isnt reporting
> anything. My friend Portscanned the box, ping'd it , everything you could
> imagen and yet /var/log/secure doesnt show anything dealing with snort at
> all. Thank you in advance to all those who help me with this small problem.
> 

	You might want to check in /var/log/snort/{portscan|alert}. Did you
turn on the portscan preprocesor? Did you set the INTERNAL/EXTERNAL/HOME_NET
variables to the network you're using? It would also help if you sent the 
command line you used to run it, and what version of snort you're using. 

-spiff




More information about the Snort-users mailing list