[Snort-users] Snort 1.8.7b6 not listen to BPF filters

Andrew R. Baker andrewb at ...950...
Fri Jul 19 13:30:03 EDT 2002


Michael Scheidell wrote:
>>Ok, had to try.  :)
>>
>>
>>>/usr/local/bin/snort -doDI -m 022 -z \
>>>-c /usr/local/etc/snort.conf -i rl0 -l /var/log/snort \
>>>not src host 10.1.1.10
>>>
>>>
>>>does not record tcp attacks.
>>
>>Ok, correct me if I'm wrong:  But that's what you want, right?
>>If that's the case then it the failure must be in the -F option.
> 
> 
> source of attack was 216.241.67.74.  Destination was 10.1.1.10
> 
> If I do this from .74:
> 
> lynx http://scanner.secnap.net/scripts/cmd-exe?dir+c../../c
> 
> WITHOUT BPF filter, it loggs attack.
> 
> If I do it WITH bpf filter, it ignores it (and 100% of the TCP attacks
> worldwide)
> 
> didn't used to do that, used to work
> 
> bpf filter is not new!
> 
> 
>>Ping thought, but does TCPdump show the same behavior when passing it a 'file'
>>of filters?
> 
> 
> snort fails if I have not src host on command line at end as well as -F
> option.


Try running Snort without the "-z" commandline option.  You are telling 
Snort to ignore packets that are not part of an established session, but 
are only letting it see half the conversation you want to see alerts for.

-A










More information about the Snort-users mailing list