[Snort-users] snort.conf and rules

Watson, Ed ewatson at ...2004...
Tue May 15 12:45:24 EDT 2001


This is what I did:

vi vision.rules

	:%s/$EXTERNAL/$EXTERNAL_NET/

and

	:%s/$INTERNAL/$HOME_NET/

default snort is looking for $EXTERNAL_NET in the rules files. same as for
$HOME_NET.

I haven't tried the [], but the above worked well for me.

Ed

-----Original Message-----
From: Bunter, Matthew [mailto:Matthew.Bunter at ...2008...]
Sent: Tuesday, May 15, 2001 5:19 AM
To: Snort-Users (E-mail)
Subject: [Snort-users] snort.conf and rules


All,

Still having problems getting snort started and would appreciate any help. 

using vision.rules (vision.rules.gz from whitehats)
Snort 1.7

Got my DNS boxes specified, no SMTP boxes on my segment (used nmap to
verify), ignoring SQL boxes therefore commented out.

Preprocessors :
defrag
http_decode: 80 8080
portscan: $HOME_NET 4 3 /var/log/snort/portscan.log
portscan-ignorehosts: $DNS_SERVERS

Output 
alert_syslog: LOG_AUTH LOG_ALERT - forgive my stupidity but does anything
need to be done to syslog.conf? DO any files need to be touched before
running snort?

Rule Set
include /etc/snort/Rules/vision.rules
My local.rules is commented out. What sort of include/ignores do people have
that isn't covered in the DNS, SQL, SMTP areas of snort.conf? Could anyone
point me to an example local.rules file?

With all the above I am getting error messages that tell me things are wrong
with the rules e.g. vision.rules (1) => Invalid CIDR block for IP addr 1024
:
If I comment this out I then get Port value missing in rule for rule 2, same
for rule 3. I'm just trying to get Snort working Please help - going crazy!

Regards,

Matt

**********************************************************************
This message may contain information which is confidential or privileged.
If you are not the intended recipient, please advise the sender immediately
by reply e-mail and delete this message and any attachments
without retaining a copy.  

**********************************************************************

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20010515/2b778f03/attachment.html>


More information about the Snort-users mailing list