[Snort-users] Snort only alert about traffic with an specific IP

Berta Alcala berta83 at ...11827...
Tue May 27 05:14:39 EDT 2008


First of all, thank you very much for your replies!

I used Ethereal and I realised that I only see traffic that involves my IP,
although the interface is in promiscuous mode. I'm connected to a switch so
the problem is there.

But in spite of this, snort doesn't work properly. There are rules that
don't work for me, for example this rule (I downloaded it form the official
site):

alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"INFO FTP Bad login";
flow:from_server,established; content:"530 ";
pcre:"/^530\s+(Login|User)/smi"; classtype:bad-unknown; sid:491; rev:8;)

I wrote this other rule because the original one doesn't work for me
(original rule, sid:1991 in chat.rules). This rule doesn't work with "flow"
options, in other rules there aren't problems with "flow" options.

alert tcp any 1863 -> $HOME_NET any (msg:"CHAT MSN Login"; flags:PA+;
content:"LoginTime"; classtype:policy-violation; sid:1000006; rev:1;)

And this other one is very similar and does not work:

alert tcp $HOME_NET any -> any 1863 (msg:"CHAT MSN logout"; flags:PA+;
content:"OUT"; classtype:policy-violation; sid:1000009; rev:1;)

I don't know what's wrong!!! It is very strange!!!! Because I'm trying
simple rules…
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20080527/b85a7830/attachment.html>


More information about the Snort-users mailing list