[Snort-users] Snort on Windows starts but doesn't create any alerts

Max Williams Max.Williams at ...14855...
Fri Apr 30 07:10:24 EDT 2010


I thought so too but have tried many combinations of
"var HOME_NET any", "var EXTERNAL_NET any", "var HOME_NET 10.1.11.0/24", "var EXTERNAL_NET <the hosts public address>"
But no luck. Setting both to "any" should work anyway right?
Cheers,
Max


-----Original Message-----
From: rmkml [mailto:rmkml at ...953...] 
Sent: 30 April 2010 09:58
To: Max Williams
Cc: rmkml at ...953...
Subject: Re: [Snort-users] Snort on Windows starts but doesn't create any alerts

Hi max,
maybe snort listenning on wrong network interface ?
Regards
Rmkml


On Fri, 30 Apr 2010, Max Williams wrote:

> Hi,
> I am new to snort but have got it running on Linux hosts with no problems. I have an issue with Windows 2008 though. I can start snort but it just doesn't register any alerts:
>
> c:\Snort\bin>snort.exe -c c:\Snort\etc\snort.conf -l C:\Snort\log -A console
>
> <snip>
>
> [ Port Based Pattern Matching Memory ]
> +-[AC-BNFA Search Info Summary]------------------------------
> | Instances        : 422
> | Patterns         : 129205
> | Pattern Chars    : 1125821
> | Num States       : 769140
> | Num Match States : 116175
> | Memory           :   18.72Mbytes
> |   Patterns       :   4.03M
> |   Match Lists    :   5.48M
> |   Transitions    :   9.11M
> +-------------------------------------------------
> [ Number of null byte prefixed patterns trimmed: 16976 ]
>
>        --== Initialization Complete ==--
>
>   ,,_     -*> Snort! <*-
>  o"  )~   Version 2.8.6-ODBC-MySQL-FlexRESP-WIN32 IPv6 GRE (Build 38)
>   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
>           Copyright (C) 1998-2010 Sourcefire, Inc., et al.
>           Using PCRE version: 7.4 2007-09-21
>           Using ZLIB version: 1.2.3
>
>           Rules Engine: SF_SNORT_DETECTION_ENGINE  Version 1.12  <Build 18>
>           Preprocessor Object: SF_SSLPP (IPV6)  Version 1.1  <Build 4>
>           Preprocessor Object: SF_SSH (IPV6)  Version 1.1  <Build 3>
>           Preprocessor Object: SF_SMTP (IPV6)  Version 1.1  <Build 9>
>           Preprocessor Object: SF_SDF (IPV6)  Version 1.1  <Build 1>
>           Preprocessor Object: SF_FTPTELNET (IPV6)  Version 1.2  <Build 13>
>           Preprocessor Object: SF_DNS (IPV6)  Version 1.1  <Build 4>
>           Preprocessor Object: SF_DCERPC (IPV6)  Version 1.1  <Build 5>
>           Preprocessor Object: SF_DCERPC2 (IPV6)  Version 1.0  <Build 3>
> Not Using PCAP_FRAMES
>
> While its running as above I've tried pinging the host with large packets and various nmap scans which all register alerts on the linux hosts but on windows nothing is printed on the console. I've got the latest rules.
> Can someone give me some pointers on how to troubleshoot this further?
> TIA and Best Regards,
> Max Williams
>
>




More information about the Snort-users mailing list