[Snort-users] No Alers In Windows: Problem with the 'established' flow control element

Mike Mike at ...12183...
Fri Jul 30 14:51:08 EDT 2004


I have been having problems for the past few days getting snort to work
correctly in windows, mainly getting it to pick up alerts.  After fooling
with some alerts myself to try and debug it, it seems that snort has some
problem with the "flow:established" option.  For some reason snort is
incorrectly tracking established connections and when I make (for example) a
web request to domain.com/cmd.exe it will only pick up the attack if I
remove the established keyword.  

Here is my original mail which contains all the info so I don't forward a
ton of stuff again:
http://marc.theaimsgroup.com/?l=snort-users&m=109114198631743&w=2


It seems this was mentioned a long time ago on the mailing list, but without
resolve:
http://marc.theaimsgroup.com/?l=snort-users&w=2&r=1&s=established+flow+worki
ng&q=b

Along with a lot of info on google:
http://www.google.com/search?sourceid=navclient&ie=UTF-8&oe=UTF-8&q=flow%3Ae
stablished+not+working

However I can't find if anyone ever resolved this in windows.  So any help
would be great!

Mike





More information about the Snort-users mailing list