[Snort-users] Beginner Help...
checkpoint at ...9765...
Thu Jul 31 14:55:03 EDT 2003
Sorry for the stupid questions... and I have RTFM'ed, but I just need some quick answers!!
I've got Snort setup as per the http://www.snort.org/docs/snort_acid_rh9.pdf instructions... but I don't see any Alert at all in Acid.
I have 2 interfaces in my Snort box, one for management and one for sniffing. The sniffer interface is connected to a switch (Cat4006) and I'm spanning our uplink port to the sniffer interface. I know that's working because if I do a tcpdump -i eth1 (the sniffer interface) I see ALL the traffic from our network...
Snort is running and supposibly logging the my mysql db - should I see the number of records increasing in a certain table to make sure the data is in fact being logged there successfully?? I've been using Retina to scan my network to attempt to generate alerts, but that hasn't worked. Is there another tool I could use to generate "naughty" traffic??
Does anyone have any thing else I can check??
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-users