[Snort-users] No Alerts Being Generated

Kaplan, Andrew H. AHKAPLAN at ...10063...
Wed Oct 6 09:26:51 EDT 2004

I am scanning the snort box itself. This is done using a remote host to scan the
snort box.

-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net]On Behalf Of Lance Boon
Sent: Wednesday, October 06, 2004 9:44 AM
To: snort-users at lists.sourceforge.net
Subject: RE: [Snort-users] No Alerts Being Generated

Are you scanning a machine on the network or the snort box itself? If
you are scanning a machine on the network and snort isn't generating any
alerts try scanning the snort box itself and see if alerts are
generated. If alerts generate when you scan the snort box but not when
you scan other machines. Then it's a switch issue I would dare to bet
and you need to set up a mirror port on your switch.

-----Original Message-----
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Kaplan,
Andrew H.
Sent: Tuesday, October 05, 2004 3:41 PM
To: 'Nigel Houghton'; Snort User Group (E-mail)
Subject: RE: [Snort-users] No Alerts Being Generated

Hi there --

I made the change within the snort.conf file you had suggested. I also
ran the
snort -T command
and it ran through the configuration without reporting back any errors.
I installed NeWT,
the Windows version of Nessus, on another machine and ran several
tests on the snort box.
The tests I ran were portscans and the "SANS Top 20" list. After the
scans were
finished, I checked
the alert file as well as the ACID GUI. Neither one mentioned any alert
conditions taking place. 

As a further test, I changed the !HOME_NET setting back to any to see if
made any difference.
It did not. What should I look for next?

-----Original Message-----
From: Nigel Houghton [mailto:nigel at ...1935...]
Sent: Wednesday, September 29, 2004 4:57 PM
To: snort-users at lists.sourceforge.net
Cc: Kaplan, Andrew H.
Subject: Re: [Snort-users] No Alerts Being Generated

Well the first thing I see in your file is the EXTERNAL_NET variable is
to any. You might want to set that to !$HOME_NET for a start.

Second, you can run snort -T -c /etc/snort/snort.conf to test your snort

Next thing is to make sure your snort box is listening on a span port of
switch or a tap or a hub (probably not using one in your case I think)
that the span port/tap is configured correctly.

Then, if possible, you could try generating some traffic that Snort
alert on, like maybe a web request for ftp.pl which should set off sid
1107. You could run some nessus tests or just do it manually with a
straightforward http://www.yourwebhost.org/ftp.pl or pick some other
rule to test.

On  0, snort-users-request at lists.sourceforge.net allegedly wrote:
>    3. No Alerts Being Generated (Kaplan, Andrew H.)
> --__--__--
> Message: 3
> From: "Kaplan, Andrew H." <AHKAPLAN at ...10063...>
> To: "Snort User Group (E-mail)" <snort-users at lists.sourceforge.net>
> Date: Wed, 29 Sep 2004 15:35:26 -0400
> Subject: [Snort-users] No Alerts Being Generated
> This message is in MIME format. Since your mail reader does not
> this format, some or all of this message may not be legible.
> ------_=_NextPart_000_01C4A65B.7895D89C
> Content-Type: text/plain;
> 	charset="iso-8859-1"
> I completed installing snort 2.2.0 (build 30) and have begun running
it. The
> ACID GUI and /var/log/snort/alert files have not shown any alerts
> even though the program has been running for over an hour. To verify
> no syntax errors in the snort.conf file, I ran the following:
> snort -c /etc/snort/snort.conf
> There were no errors and warnings, and the program appears to be
> properly. Where in snort.conf and elsewhere, should I check for 
> configuration mistakes? I have included the snort.conf file here.
>  <<snort.conf.29sept04.txt>> 
> --__--__--
    Nigel Houghton      Research Engineer       Sourcefire Inc.
                  Vulnerability Research Team

 Cat: "Forget red - let's go all the way up to brown alert!"
 Kryten: "There's no such thing as a brown alert sir."
 Cat: "You won't be saying that in a minute!"

This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:

More information about the Snort-users mailing list