[Snort-users] Problem with acquiring traffic

Alex Adamos alexthakidadam at ...125...
Sat Feb 23 13:58:15 EST 2013

i wrote my own preprocessor to track flows to a webserver and determine whether the server is under a slow http DoS attack. Now i want to test my preprocessor and see "how many fish i can get" (greek one, :p)!! I've installed Snort in an Ubuntu virtualBox Guest (the Host is a Windows7). To automate the tests i wrote a bash script that every time starts Snort (with a different configuration for my preprocessor) and starts the attack/s. So the Snort installation and the attacker/s should be on the same machine. For this reason, I thought that i should capture traffic from the lo interface. But so far, i can't get any of the attacker's packets.Also, in -dev mode i get WARNING: Bad Traffic Same Src/Dst IPWARNING: Bad Traffic Loopback IPIs this preventing my preprocessor from getting packets?
If i run an attack from my Host or from another virtual machine and start Snort for the eth1 interface (virtualBox host-only adapter,"It can be thought of as a hybrid between the bridged and internal networking modes: as with bridged networking, the virtual machines can talk to each other and the host as if they were connected through a physical ethernet switch") i get the traffic right and preprocessor works fine...
I really need help with this !!Thanks,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130223/a1672d31/attachment.html>

More information about the Snort-users mailing list