[Snort-users] SNORT Installed properly But not Logging alerts

ARUN PUSHKAR arunpushkar at ...11827...
Thu Feb 21 06:21:18 EST 2013


SOLVED as snort-rule-snapshot-2940 does not have default rule for bad
traffic from 'http://testmyids.com' so you have to create rule for it in
local.rules eg.alert ip any any -> any any (msg:"ATTACK-RESPONSES id check
returned root";
content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:498; rev:6;)

On Wed, Feb 20, 2013 at 10:58 PM, ARUN PUSHKAR <arunpushkar at ...11827...>wrote:

> Yes it was ment for testing only, for confirming its correct installation,
> which worked fine. What i am asking is, when i run it normally(without -T)
> giving: ' sudo snort -c /usr/local/snort/etc/snort.conf -l /var/log/snort
> -i eth0 ' on command prompt it is not logging alerts in unified2 file which
> remains 0 bytes. for testing i am using ' curl http://testmyids.com '.
> problem is still not resolved
>
>
> On Wed, Feb 20, 2013 at 9:34 PM, Dustin Webber <dustin.webber at ...11827...>wrote:
>
>> You are using -T which I believe is test mode. So getting an exit status
>> is expected behavior.
>>
>> On Feb 20, 2013, at 9:55 AM, ARUN PUSHKAR <arunpushkar at ...11827...> wrote:
>>
>> *I have installed snort and after installation when i run following:*
>>
>> sudo snort -c /usr/local/snort/etc/snort.conf
>> –dump-dynamic-rules=/usr/local/snort/so_rules
>>
>> *I Get:*
>>
>> Finished dumping dynamic rules.
>>
>> Snort exiting
>>
>> *When i run this:*
>>
>> sudo snort -c /usr/local/snort/etc/snort.conf -T -l /var/log/snort
>>
>> *I Get:*
>>
>> Snort successfully validated the configuration!
>>
>> Snort exiting
>>
>> *When i Run:*
>>
>> /usr/local/snort/bin/snort -i eth0
>>
>> *I can see traffic but when i use ' curl http://testmyids.com ' for
>> testing SNORT installation it does not gives any alert in unified2 file
>> which is being logged in /var/log/snort*
>>
>> *snort config file has this line for logging into unified file :*
>>
>> output unified2: filename unified.snort.alert, limit 128
>>
>> *And for starting snort i am using:*
>>
>> sudo snort -c /usr/local/snort/etc/snort.conf -l /var/log/snort -i eth0
>>
>> *Every thing seems to be right but why is it not logging alerts ?*
>>
>>
>>
>>
>> --
>> Arun Pushkar
>> 09043404301
>>
>>
>> ------------------------------------------------------------------------------
>> Everyone hates slow websites. So do we.
>> Make your web apps faster with AppDynamics
>> Download AppDynamics Lite for free today:
>> http://p.sf.net/sfu/appdyn_d2d_feb
>>
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>>
>> Please visit http://blog.snort.org to stay current on all the latest
>> Snort news!
>>
>>
>
>
> --
> Arun Pushkar
> 09043404301
>



-- 
Arun Pushkar
09043404301
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130221/ba999b2a/attachment.html>


More information about the Snort-users mailing list