[Snort-users] Strange snort behaviour, failure to log all traffic.

hulver hulver at ...11827...
Fri Jun 17 04:21:35 EDT 2005


I'm having some very strange problems with snort not capturing all packets.

I've been running snort for ages, and I've recently upgraded it to try
and fix this problem, I'm now running snort 2.3.3 (build 14). I
compiled it from source. My libpcap is 0.7. I'm running it on Debian
machine running a 2.4.18 kernel.

My problem is, snort only logs traffic where the sensors IP address is
involved. My sensor is 192.168.1.3, and the only stuff in my logs is
to or from IP 192.168.1.3. It used to log all traffic going past the
sensor (which is installed next to the router).

Now, here's the strange part.

If I run "snort -v" from the command line, I can see all traffic to
all IP's on my network. What's even stranger, is that if I run "snort
-v" suddenly the daemon version will also start logging that traffic
as well.

I set up a rule to test this.

ruletype logall
{
  type log
  output log_tcpdump: complaint.log
}
logall tcp 62.172.x.x any <> any any
logall udp 62.172.x.x any <> any any
logall icmp 62.172.x.x any <> any any

I restarted snort, and started pinging the 62.172.x.x address from
another machine on the network. Nothing was logged. I then ran "snort
-v > /dev/null &" and did then ping again. Now packets started getting
logged to the log file. I stopped the "snort -v" instance and ran the
ping again. Nothing was logged.

I've checked, and the interface is in PROMISC mode no matter how many
instances of snort I'm running, but I only get to log all traffic if I
run a "snort -v" in the background.

Can anybody help?

-- 
http://www.hulver.com/scoop/




More information about the Snort-users mailing list