[Snort-users] Snort only alert about traffic with an specific IP

Leon Ward seclists at ...14165...
Mon May 26 09:23:18 EDT 2008

Sounds like a data presentation issue to me.
Check Snort is seeing the traffic that you think it should be.

snort -vdei eth0

or check it out with another sniffer like tcpdump. Was the rule that  
didn't involve your IP a broadcast packet?


On 26 May 2008, at 11:13, Berta Alcala wrote:

> Hello,
> I have many problems with snort, for example some rules work fine  
> and others don't work. But what surprises me a lot is that snort  
> only alert about rules with my IP (where snort is installed) as  
> source or destination .
> I've tried with this rule:
> alert tcp any any -> any any (msg:"TCP traffic";sid:1000011; rev:1;)
> The only alerts registrated are those which have my IP. I don't  
> understang anything.
> I have this information in snort.conf:
> var HOME_NET
> var EXTERNAL_NET any
> Snort is installed in There are many others IPs  
> availables in my network.
> Other rare thing, I changed $EXTERNAL_NET to any in a rule and then  
> it worked, but I have rules with $EXTERNAL_NET that work fine.
> (I use Windows XP+Snort 2.7+Base)
> Thank you very much for any idea
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2008.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/_______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

More information about the Snort-users mailing list