[Snort-users] not load snort rules when I use -D option

Pablo Nebrera pablonebrera at ...13472...
Tue Sep 6 03:41:20 EDT 2005


I solved the problem :-D

The problem was I started snort as follow:

/usr/sbin/snort -m 027 -d -D -l /var/log/snort -S HOME_NET=[0.0.0.0] -u
root -g root -c /etc/snort/snort.conf -i br0

and I had to put 0.0.0.0/0  :-D (stupid boy)

It doesn't tell me in the syslog, when I start snort, that snort has
loaded the rules either, but the rules works!!! That was the confusion. 

Now if I scan the ports, snort will log for the rules and for the
preprocessors.

Thanks for your help


Pablo




El lun, 05-09-2005 a las 12:10 -0400, Jason Brvenik escribió:
> More information is needed. Check doc/BUGS or an online version from CVS
> 
> http://cvs.snort.org/viewcvs.cgi/snort/doc/BUGS?rev=1.9&content-type=text/vnd.viewcvs-markup
> 
> T.C. wrote:
> > I also found that, even I use /usr/sbin/snort -Dd -c /var/log/snort
> > I can start it.  After for couples of day, the snort would disapear
> > from the "ps -ef" list
> > 
> > What's wrong with snort???
> > 
> > T.C.
> > 
> > 
> > ----- Original Message ----- From: "Pablo Nebrera" 
> > <pablonebrera at ...13472...>
> > To: <snort-users at lists.sourceforge.net>
> > Sent: Monday, September 05, 2005 7:25 PM
> > Subject: [Snort-users] not load snort rules when I use -D option
> > 
> > 
> >> I have a problem when I start snort. I use:
> >>
> >> /usr/sbin/snort -m 027 -d -D -l /var/log/snort -u root -g root
> >> -c /etc/snort/snort.conf -i br0
> >>
> >> and snort doesn load the rules.
> >>
> >> If I start snort with out the -D option it loads the rules perfectly.
> >>
> >> What is the problem???
> >>
> >> I can start snort using daemon tools but I would like to use it by this
> >> form.
> >>
> >> Thanks for the help
> >>
> >>
> >> Pablo
> >>
> >>
> >>
> >> -------------------------------------------------------
> >> SF.Net email is Sponsored by the Better Software Conference & EXPO
> >> September 19-22, 2005 * San Francisco, CA * Development Lifecycle 
> >> Practices
> >> Agile & Plan-Driven Development * Managing Projects & Teams * Testing 
> >> & QA
> >> Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
> >> _______________________________________________
> >> Snort-users mailing list
> >> Snort-users at lists.sourceforge.net
> >> Go to this URL to change user options or unsubscribe:
> >> https://lists.sourceforge.net/lists/listinfo/snort-users
> >> Snort-users list archive:
> >> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >>
> > 
> > 
> > -------------------------------------------------------
> > SF.Net email is Sponsored by the Better Software Conference & EXPO
> > September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
> > Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
> > Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > 
> 
> 
> -------------------------------------------------------
> SF.Net email is Sponsored by the Better Software Conference & EXPO
> September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
> Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
> Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 





More information about the Snort-users mailing list