[Snort-users] RE: Snort-users digest, Vol 1 #3302 - 13 msgs

edward.hawkins at ...9405... edward.hawkins at ...9405...
Fri Jun 27 05:04:09 EDT 2003


How is Home_Net defined when using SnortCenter.  

I have installed acid and snortcenter and based on the install process how
do you specifically define your home_net in snortcenter?  I know how to
manually do it but how do you do it in snortcenter?

-----Original Message-----
From: snort-users-request at lists.sourceforge.net
[mailto:snort-users-request at lists.sourceforge.net] 
Sent: Thursday, June 26, 2003 12:01 PM
To: snort-users at lists.sourceforge.net
Subject: Snort-users digest, Vol 1 #3302 - 13 msgs

Send Snort-users mailing list submissions to
	snort-users at lists.sourceforge.net

To subscribe or unsubscribe via the World Wide Web, visit
	https://lists.sourceforge.net/lists/listinfo/snort-users
or, via email, send a message with subject or body 'help' to
	snort-users-request at lists.sourceforge.net

You can reach the person managing the list at
	snort-users-admin at lists.sourceforge.net

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-users digest..."


Today's Topics:

   1. Re: fatal error starting snort (Jason K. Boykin)
   2. Re: Log vs Alert (Erek Adams)
   3. Re: Snort rule question (Erek Adams)
   4. Re: re: snortcenter/using a sensor with no ip address (Erek Adams)
   5. Re: fatal error starting snort (Erek Adams)
   6. RE: Snort Sensor Placement Outside Firewall (Erek Adams)
   7. RE: Re.: Snort Sensor Placement Outside Firewall (Michael Steele)
   8. Fw: [Snort-users] Snort Sensor Placement Outside Firewall (Tom Sevy)
   9. Re: Log vs Alert (list)
  10. trouble specifying more than one HOME_NET variable (Philip Davidson)
  11. hardware requirements (Brei, Matt)
  12. Alerts not Detected during Import? (Dusty Hall)
  13. Re: trouble specifying more than one HOME_NET variable (Erek Adams)

--__--__--

Message: 1
From: "Jason K. Boykin" <jboykin at ...9552...>
Organization: Summit Research Corp.
To: "'snort-users at lists.sourceforge.net'"
<snort-users at lists.sourceforge.net>
Subject: Re: [Snort-users] fatal error starting snort
Date: Thu, 26 Jun 2003 08:21:24 -0500

> Erek,
>
> I'm afraid that you'r wrong here- snortcenter doesn't seem to support
> Snort 2.0 properly, and although there are submitted patches they'r not
> included into snortcenter yet.
>
> Cheers,
>
> Joerg

If you look here
http://users.pandora.be/larc/
the page says there is support for snortcenter with snort 2.0

Ive got a friend running it with mysql and it works great for him.  I how=
ever=20
tried getting it to run with postgres and no luck there so far.  Gotta fi=
nd=20
more time to play with it though.  It appears to be timing out or freezin=
g on=20
some of the java menu functions for me on 3 different browsers.


--__--__--

Message: 2
Date: Thu, 26 Jun 2003 09:28:54 -0400 (EDT)
From: Erek Adams <erek at ...950...>
To: Matt Geiger <geigerreal at ...125...>
cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Log vs Alert

On Wed, 25 Jun 2003, Matt Geiger wrote:

> What is the difference between
> output database: log and output database: alert?
> I looked in the readme.database and that was no help.  This is a newbie
> question I know, but alert just seems to do more and take longer.

	http://www.theadamsfamily.net/~erek/snort/logging_methods.txt

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


--__--__--

Message: 3
Date: Thu, 26 Jun 2003 09:31:31 -0400 (EDT)
From: Erek Adams <erek at ...950...>
To: James Lay <slave_tothe_box at ...131...>
cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Snort rule question

On Thu, 26 Jun 2003, James Lay wrote:

> So ok....trying to catch those naughty spammers using:
>
> alert tcp $SMTP_SERVERS 25 -> $EXTERNAL_NET any (msg:"Open Mail Relay
Attempt"; content:"Relay access denied"; classtype:mail-abuse; sid:1000001;
rev:1;)
>
> Now the above rule works.  I originally had:
>
> alert tcp $EXTERNAL_NET any <- $SMTP_SERVERS 25 (msg:"Open Mail Relay
Attempt"; content:"Relay access denied"; classtype:mail-abuse; sid:1000001;
rev:1;)
>
> And it did not work.  Any reason the two aren't equivalent?

Well logically they are....

The <- operator never really worked and was removed from the code.  What
version of Snort are you running?  Recent versions should have said that
the <- was invalid.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


--__--__--

Message: 4
Date: Thu, 26 Jun 2003 09:38:15 -0400 (EDT)
From: Erek Adams <erek at ...950...>
To: lindsay.hunt at ...9431...
cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] re: snortcenter/using a sensor with no ip address

On Thu, 26 Jun 2003 lindsay.hunt at ...9431... wrote:

> I am running Snort 2.0 with Acid on Redhat 8. The Snort box has 2
> interfaces; eth0 has an ip address and is used to administer the box; eth1
> doesn't have an ip address and is plugged into a mirror port.  I am
running
> snort with the '-i eth1' option.   I have installed Snortcenter and would
> like to use it to simplify rule management.  When I attempt to add the
> sensor eth1 (no ip address) in Snortcenter, it appears that Snortcenter
> wants an ip address for the sensor. When I attempt to push the rule set to
> the sensor and then reload, Snortcenter complains that it cannot connect
to
> eth1 due to the fact that it doesn't have an ip address. Is there a way
> around this?

<smart_ass_answer_mode>

Sure!  It's an easy fix!  Don't use Snortcenter.

</smart_ass_answer_mode>

Seriously, don't use it.  There seems to be a few issues with Snortcenter
and v2.0.  I'd suggest that until they are worked out, that it's not used.

If this truly is an error with SC, then you'll need to see if the
author(s) can get that fixed.  If it's a problem with your startup script,
then that's a different issue.  What are the specifics of your error?

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


--__--__--

Message: 5
Date: Thu, 26 Jun 2003 09:43:13 -0400 (EDT)
From: Erek Adams <erek at ...950...>
To: Joerg Weber <j.weber at ...8292...>
cc:
  "'snort-users at lists.sourceforge.net'" <snort-users at lists.sourceforge.net>
Subject: Re: [Snort-users] fatal error starting snort

On Thu, 26 Jun 2003, Joerg Weber wrote:

> I'm afraid that you'r wrong here- snortcenter doesn't seem to support
> Snort 2.0 properly, and although there are submitted patches they'r not
> included into snortcenter yet.

Hrm...  I guess the Snortcenter webpage needs an update to that fact then.

Besides, with Snortcenter and IDSCenter is it any wonder that I get
confused?!  ;-)

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


--__--__--

Message: 6
Date: Thu, 26 Jun 2003 09:51:25 -0400 (EDT)
From: Erek Adams <erek at ...950...>
To: Michael Steele <michaels at ...9077...>
cc: 'Rich Lichvar' <rlichvar at ...9486...>,
  "'Snort Users List (E-mail)'" <snort-users at lists.sourceforge.net>
Subject: RE: [Snort-users] Snort Sensor Placement Outside Firewall

On Wed, 25 Jun 2003, Michael Steele wrote:

> You forgot to mention the time that may be involved in sorting through the
> massive amount of data with a sensor on the outside.

More like "didn't mention" vs. "forgot".  Usually unless someone is just
feeling masochistic, the information overload from outside the firewall is
usually changed/toned down ASAP.

> What could be some of the possibilities that make that scenario a possible
> solution, when the IDS could or should in most cases be placed on the near
> side of the firewall?

	http://www.theadamsfamily.net/~erek/snort/ids_placement.txt

That one has been beaten to death so many times it's not even funny.  You
can place it before or after the FW, but I think that's a choice that has
to be made after testing.  I don't think there is a hard and fast answer
to 'where?'.  You're going to almost always have to test/retest to check
out how it works and how you want to handle it.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


--__--__--

Message: 7
From: "Michael Steele" <michaels at ...9077...>
To: <rlichvar at ...9486...>,
	"'Snort Users List \(E-mail\)'" <snort-users at lists.sourceforge.net>
Subject: RE: [Snort-users] Re.: Snort Sensor Placement Outside Firewall
Date: Thu, 26 Jun 2003 07:23:14 -0700

Rich,

Thanks for the acknowledgements :)

Even though companies sell commercial sensors and they have great =
support,
they don't know everything, and it is a very good idea to seek =
alternative
answers elsewhere, like in the snort-users forum. That list has a wealth =
of
knowledge behind it and should be utilized whenever possible.

You took the incentive to go outside the box and seek other alternatives =
and
my hat goes off to you, most would have settled with the canned answer =
from
the support department.

Cheers...

-Michael Steele
--=20
 System Engineer / Security Support Technician    =20
 mailto:michaels at ...9077...   =20
 Website: http://www.winsnort.com
 Snort: Open Source Network IDS - http://www.snort.org


-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Rich =
Lichvar
Sent: Thursday, June 26, 2003 6:11 AM
To: Snort Users List (E-mail)
Subject: [Snort-users] Re.: Snort Sensor Placement Outside Firewall

We decided to dump the idea for now. Given the massive amount of data =
that
would be collected and the lack of time to analyze it, this seems to be =
the
best path for us (and probably a bad idea anyway).

BTW, many thanks to Michael Steele of Silicon Defense. We're using the
Silicon Defense Sentrus boxes and are, on the whole, quite happy with =
them.
(Any problems we've had have been ours, not theirs.) Michael has been a
great help to us in getting our Sentrus boxes and Snort running on them,
back up to snuff.

Richard L. Lichvar
Director, Operations
Knowledge Resource Center, Inc.
Phone: 703-848-2100 x228
Fax: 703-848-4747
Mobile: 571-221-3430



-------------------------------------------------------
This SF.Net email is sponsored by: INetU
Attention Web Developers & Consultants: Become An INetU Hosting Partner.
Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
INetU Dedicated Managed Hosting http://www.inetu.net/partner/index.php
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=3Dsnort-users





--__--__--

Message: 8
From: "Tom Sevy" <tsevy at ...1701...>
To: <Snort-users at lists.sourceforge.net>
Subject: Fw: [Snort-users] Snort Sensor Placement Outside Firewall
Date: Thu, 26 Jun 2003 10:52:16 -0400

Put it on the outside for testing -- you should get more data than on the
inside.  Then decide after the testing about where to position it as Erek
said.

On Wed, 25 Jun 2003, Michael Steele wrote:

> You forgot to mention the time that may be involved in sorting through the
> massive amount of data with a sensor on the outside.

More like "didn't mention" vs. "forgot".  Usually unless someone is just
feeling masochistic, the information overload from outside the firewall is
usually changed/toned down ASAP.

> What could be some of the possibilities that make that scenario a possible
> solution, when the IDS could or should in most cases be placed on the near
> side of the firewall?

http://www.theadamsfamily.net/~erek/snort/ids_placement.txt

That one has been beaten to death so many times it's not even funny.  You
can place it before or after the FW, but I think that's a choice that has
to be made after testing.  I don't think there is a hard and fast answer
to 'where?'.  You're going to almost always have to test/retest to check
out how it works and how you want to handle it.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson





--__--__--

Message: 9
From: "list" <list at ...3899...>
To: Erek Adams <erek at ...950...>, Matt Geiger <geigerreal at ...125...>
Cc: snort-users at lists.sourceforge.net
Subject: Re: [Snort-users] Log vs Alert
Date: Thu, 26 Jun 2003 08:48:37 -0600

After reading the link below...can I have snort write both logs and alerts
to 
the database..???

Thanks

GSR

> On Wed, 25 Jun 2003, Matt Geiger wrote:
> 
> > What is the difference between
> > output database: log and output database: alert?
> > I looked in the readme.database and that was no help.  This is a newbie
> > question I know, but alert just seems to do more and take longer.
> 
> 	http://www.theadamsfamily.net/~erek/snort/logging_methods.txt
> 
> Cheers!
> 
> -----
> Erek Adams
> 
>    "When things get weird, the weird turn pro."   H.S. Thompson
> 
> -------------------------------------------------------
> This SF.Net email is sponsored by: INetU
> Attention Web Developers & Consultants: Become An INetU Hosting Partner.
> Refer Dedicated Servers. We Manage Them. You Get 10% Monthly Commission!
> INetU Dedicated Managed Hosting 
> http://www.inetu.net/partner/index.php 
_______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


--
Open WebMail Project (http://openwebmail.org)



--__--__--

Message: 10
From: Philip Davidson <Philip at ...8580...>
To: "Snort Users (snort-users at lists.sourceforge.net)"
	 <snort-users at lists.sourceforge.net>
Date: Thu, 26 Jun 2003 10:44:26 -0500
Subject: [Snort-users] trouble specifying more than one HOME_NET variable

Hello all,

I am trying to specify my $HOME_NET variable to be two separate internal
LANs.  
After making the below change, I tried to start snort back up and it would
not start.  After issuing a "/etc/init.d/snort start",  my startup script
tells me that it is up and running.
But then I issue a "ps -ef|grep snort" and there is no snort.
Any idears?

Here is a section of my conf:


var HOME_NET [192.168.1.0/24,192.168.5.0/24]

# Set up the external network addresses as well.
# A good start may be "any"

var EXTERNAL_NET !$HOME_NET

# Configure your server lists.  This allows snort to only look for attacks
# to systems that have a service up.  Why look for HTTP attacks if you are
# not running a web server?  This allows quick filtering based on IP
addresses
# These configurations MUST follow the same configuration scheme as defined
# above for $HOME_NET.

# List of DNS servers on your network
var DNS_SERVERS $HOME_NET

# List of SMTP servers on your network
var SMTP_SERVERS $HOME_NET

# List of web servers on your network
var HTTP_SERVERS $HOME_NET

# List of sql servers on your network
var SQL_SERVERS $HOME_NET

# List of telnet servers on your network
var TELNET_SERVERS $HOME_NET

# Configure your service ports.  This allows snort to look for attacks
# destined to a specific application only on the ports that application
# runs on.  For example, if you run a web server on port 8081, set your
# HTTP_PORTS variable like this:
#
# var HTTP_PORTS 8081
#
# Port lists must either be continuous [eg 80:8080], or a single port [eg
80].
# We will adding support for a real list of ports in the future.

# Ports you run web servers on
var HTTP_PORTS 80

# Ports you want to look for SHELLCODE on.
var SHELLCODE_PORTS !80

# Ports you do oracle attacks on
var ORACLE_PORTS 1521



Thanks in advance


Philip Davidson
DPC, Inc.
1015 Maurice Fields Dr.
Paris, TN 38242
731-642-8627



--__--__--

Message: 11
Date: Thu, 26 Jun 2003 11:56:11 -0400
From: "Brei, Matt" <mbrei at ...8727...>
To: <snort-users at lists.sourceforge.net>
Subject: [Snort-users] hardware requirements

This is a multi-part message in MIME format.

------_=_NextPart_001_01C33BFB.76C05906
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Greetings,

=20

I would like to get an idea on what type of hardware you are all running
snort on and what size network it services.  I plan on using
snort/MySQL/acid to monitor internet usage and log policy violation on a
network with about 100 users.  I have the same basic set up at home with
snort running on a 450 K6-2 logging to MySQL/acid on a 1100 Athlon both
using PC133 and standard IDE drives (ATA100 and UDMA66).  With this many
users and having all of the components (snort/MySQL/acid) all on 1
machine, would It be a good idea to go with SCSI, DDR and 10/100/1000?
This setup also needs to be scalable up to about 250 users.

=20

=20

Thanks,

Matt Brei

=20


------_=_NextPart_001_01C33BFB.76C05906
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<html>

<head>
<meta http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<meta name=3DGenerator content=3D"Microsoft Word 10 (filtered)">

<style>
<!--
 /* Font Definitions */
 @font-face
	{font-family:"Comic Sans MS";
	panose-1:3 15 7 2 3 3 2 2 2 4;}
 /* Style Definitions */
 p.MsoNormal, li.MsoNormal, div.MsoNormal
	{margin:0in;
	margin-bottom:.0001pt;
	font-size:12.0pt;
	font-family:"Times New Roman";}
a:link, span.MsoHyperlink
	{color:blue;
	text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
	{color:purple;
	text-decoration:underline;}
span.EmailStyle17
	{font-family:Arial;
	color:windowtext;}
@page Section1
	{size:8.5in 11.0in;
	margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
	{page:Section1;}
-->
</style>

</head>

<body lang=3DEN-US link=3Dblue vlink=3Dpurple>

<div class=3DSection1>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Greetings,</span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>I would like to get an idea on what type of hardware =
you are
all running snort on and what size network it services.  I plan on =
using
snort/MySQL/acid to monitor internet usage and log policy violation on a =
network
with about 100 users.  I have the same basic set up at home with =
snort
running on a 450 K6-2 logging to MySQL/acid on a 1100 Athlon both using =
PC133
and standard IDE drives (ATA100 and UDMA66).  With this many users =
and
having all of the components (snort/MySQL/acid) all on 1 machine, would =
It be a
good idea to go with SCSI, DDR and 10/100/1000?  This setup also =
needs to
be scalable up to about 250 users.</span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'> </span></font></p>

<p class=3DMsoNormal><font size=3D2 face=3DArial><span =
style=3D'font-size:10.0pt;
font-family:Arial'>Thanks,</span></font></p>

<p class=3DMsoNormal><strong><b><font size=3D2 color=3D"#0000a0" =
face=3D"Comic Sans MS"><span
style=3D'font-size:10.0pt;font-family:"Comic Sans =
MS";color:#0000A0'>Matt Brei</span></font></b></strong></p>

<p class=3DMsoNormal><font size=3D3 face=3D"Times New Roman"><span =
style=3D'font-size:
12.0pt'> </span></font></p>

</div>

</body>

</html>
=00
------_=_NextPart_001_01C33BFB.76C05906--


--__--__--

Message: 12
Date: Thu, 26 Jun 2003 10:58:50 -0500
From: "Dusty Hall" <halljer at ...8709...>
To: <Snort-users at lists.sourceforge.net>
Subject: [Snort-users] Alerts not Detected during Import?

We are experiencing a problem with Snort not reporting Alerts that we
have in our rules files.  Here's some background:

We copy our Snort tcpdump logs from our sniffer to our MySQL/ACID
system and then import the tcpdump logs into ACID/MySQL.  From the looks
of our alert files the Specific alerts were detected by our sniffer but
not by Snort on our DB box.  So what I'm trying to ask is, does the
tcpdump log files from our sniffer box have all detected alerts in
tcpdump format that were sniffed on the wire?  Is there enough
information from the tcpdump files from our sniffer to process again and
pull out the same alerts?  Here's the steps we use: (Yes we have
identicial rules on both systems and both have the same version of
Snort.)

Sniffer: 
  
  snort.conf output snip -> "output log_tcpdump: snort-log"

  /usr/local/bin/snort -c /usr/local/snort/etc/snort.conf -D -b -o -i
eth1 -A fast

-------

DB Import:

  snort.conf output snip -> "output database: alert, mysql, user=snort
password=xxxxxxx dbname=snort host=localhost"

  /usr/local/bin/snort -N -dve -c /usr/local/snort/etc/snort.conf -l
/usr/local/snort/logs -dr
/usr/local/snort_logs/tcplogs/snort-logifle.log


Note: After I run the import and look at the newly created "alert"
file, it is much smaller than the "alert" file from our sniffer.  

Any help would be greatly appreciated.  I'm open to new ways of doing
this!

Thanks,


-Dusty




--__--__--

Message: 13
Date: Thu, 26 Jun 2003 12:00:18 -0400 (EDT)
From: Erek Adams <erek at ...950...>
To: Philip Davidson <Philip at ...8580...>
cc:
  "Snort Users (snort-users at lists.sourceforge.net)"
<snort-users at lists.sourceforge.net>
Subject: Re: [Snort-users] trouble specifying more than one HOME_NET
variable

On Thu, 26 Jun 2003, Philip Davidson wrote:

> I am trying to specify my $HOME_NET variable to be two separate internal
> LANs.

Easily done.

> After making the below change, I tried to start snort back up and it would
> not start.  After issuing a "/etc/init.d/snort start",  my startup script
> tells me that it is up and running.
> But then I issue a "ps -ef|grep snort" and there is no snort.
> Any idears?
>
> Here is a section of my conf:
>
>
> var HOME_NET [192.168.1.0/24,192.168.5.0/24]

[...snip...]

That's fine.  It sounds like there is another error in your snort.conf.
I'll also bet that your startup script calls Snort with the '-D'
parameter.  To check for your real error, just start Snort as your script
does just without the '-D'.  Then you should see your true error.  Once
you have that, let us know and we'll see what we can do.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson



--__--__--

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-users


End of Snort-users Digest




More information about the Snort-users mailing list