scottt at ...4859...
Tue Feb 19 13:44:07 EST 2002
I'm running snort 1.8.3-5 on Redhat 7.1. Libpcap
is 0.6.2-9. Below is showing how my sensor is
located. The external ip of my firewall is
x.x.x.27 and the ip on my sensor is x.x.x.223
the subnet mask from my isp is 255.255.255.0
I've set my snort.conf home_net and all the
variables regarding ip address's to "any". If I
run snort in sniffer mode I can see traffic. If
I run in NIDS mode it shows nothing in the logs.
even if I go to grc.com and do a portscan it
show's nothing in /var/log/snort/alert or
portscan.log . There is also a file snort-
timestamp.log but it is in binary format. I'm
trying to setup Snort Snarf to read the log's.
When I run it it generates the page but there
are no alerts. It shows it's looking in alerts
and portscan.log. Here's the command I'm running
snort -l /var/log/snort -
c /etc/snort/snort.conf -o -b -A FULL -z est
How do I read what's in the snort-timestamp.log?
Why is it now logging any alerts or portscans?
Thanks for any help and take three drinks if
your so inclined.
THERE IS ONLY ONE...
SOCCER.COM, The Center of the Soccer Universe
More information about the Snort-users